Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

techcrunch.com

Post reply on HN
Print view View original

71–80 of 694 posts

Re: Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

#71

Post by eddyg »

tokyobreakfast wrote: post #8

This is almost certainly users who elect to store their BitLocker keys in OneDrive. Don't think Apple wouldn't do the same. If you don't want other people to have access to your keys, don't give your keys to other people.

You shouldn't include Apple in this.

As of macOS Tahoe, the FileVault key you (optionally) escrow with Apple is stored in the iCloud Keychain, which is cryptographically secured by HSM-backed, rate-limited protections.

You can (and should) watch https://www.youtube.com/watch?v=BLGFriOKz6U&t=1993s for all the details about how iCloud is protected.

Re: Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

#72

Post by eddyg »

tokyobreakfast wrote: post #52
ezfe wrote: post #46

Earlier quoted context omitted.

Apple's solution is iCloud Keychain which is E2E encrypted, so would not be revealed with a court order.

What is your proof they don't have a duplicate key that also unlocks it? A firm handshake from Tim?

You should watch the whole BlackHat talk (from 2016!) from Apple's Head of Security Engineering and Architecture, but especially this part:

https://www.youtube.com/watch?v=BLGFriOKz6U&t=1993s

Re: Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

#73

Post by smegger001 »

halfmatthalfcat wrote: post #39
tokyobreakfast wrote: post #28

Earlier quoted context omitted.

>even a cosmic ray flipping the "do not upload" bit in memory Stats on this very likely scenario?

It's "HN-likely" which translates to "almost never" in reality.

if cosmic ray bit flips were so rare then ecc ram wouldn't be a thing.

Re: Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

#74

Post by gruez »

vik0 wrote: post #32
Aurornis wrote: post #5

FYI BitLocker is on by default in Windows 11. The defaults will also upload the BitLocker key to a Microsoft Account if available. This is why the FBI can compel Microsoft to provide the keys. It's possible, perhaps even likely, that the suspect didn't even know they had an encrypted laptop. Journalists love the "Microsoft gave " framing because it makes Microsoft sound like they're handing these out because they lik…

You can always count on someone coming along and defending the multi-trillion dollar corporation that just so happens to take a screenshot of your screen every few seconds (among many, many - too many other things)

Yes, because object level facts matter, and it's intellectually dishonest to ignore the facts and go straight into analyzing which side is the most righteous, like:

>Microsoft is an evil corporation, so we must take all bad stories about them at face value. You're not some corpo bootlicker, now, are you? Now, in unrelated news, I heard Pfizer, another evil corporation with a dodgy history[1] is insisting their vaccines are safe...

[1] https://en.wikipedia.org/wiki/Pfizer#Legal_issues

Re: Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

#75

Post by Aurornis »

ferrouswheel wrote: post #45

It's interesting how many comments these days are like, "well of course". Back in the day hackernews had some fire and resistance. Too many tech workers decided to rollover for the government and that's why we are in this mess now. This isn't an argument about law, it's about designing secure systems. And lazy engineers build lazy key escrow the government can exploit.

> Back in the day hackernews had some fire and resistance.

Most of the comments are fire and resistance, but they commonly take ragebait and run with the assumptions built-in to clickbait headlines.

> Too many tech workers decided to rollover for the government and that's why we are in this mess now.

I take it you've never worked at a company when law enforcement comes knocking for data?

The internet tough guy fantasy where you boldly refuse to provide the data doesn't last very long when you realize that it just means you're going to be crushed by the law and they're getting the data anyway.

Re: Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

#76

Post by yoyohello13 »

vik0 wrote: post #32
Aurornis wrote: post #5

FYI BitLocker is on by default in Windows 11. The defaults will also upload the BitLocker key to a Microsoft Account if available. This is why the FBI can compel Microsoft to provide the keys. It's possible, perhaps even likely, that the suspect didn't even know they had an encrypted laptop. Journalists love the "Microsoft gave " framing because it makes Microsoft sound like they're handing these out because they lik…

You can always count on someone coming along and defending the multi-trillion dollar corporation that just so happens to take a screenshot of your screen every few seconds (among many, many - too many other things)

I big demographic of HN users are people who want to be the multi-trillion dollar corporation so it’s not too surprising. In this case though I think they are right. And I’m a big time Microsoft hater.

Re: Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

#77

Post by drnick1 »

Aurornis wrote: post #5

FYI BitLocker is on by default in Windows 11. The defaults will also upload the BitLocker key to a Microsoft Account if available. This is why the FBI can compel Microsoft to provide the keys. It's possible, perhaps even likely, that the suspect didn't even know they had an encrypted laptop. Journalists love the "Microsoft gave " framing because it makes Microsoft sound like they're handing these out because they lik…

> Any power users who prefer their own key management should follow the steps to enable Bitlocker without uploading keys to a connected Microsoft account.

The real issue is that you can't be sure that the keys aren't uploaded even if you opt out.

At this point, the only thing that can restore trust in Microsoft is open sourcing Windows.

Re: Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

#78

Post by jcalvinowens »

ezfe wrote: post #46
giobox wrote: post #26

Earlier quoted context omitted.

> Don't think Apple wouldn't do the same. Of course Apple offers a similar feature. I know lots of people here are going to argue you should never share the key with a third party, but if Apple and Microsoft didn't offer key escrow they would be inundated with requests from ordinary users to unlock computers they have lost the key for. The average user does not understand the security model and is rarely going to sto…

Apple's solution is iCloud Keychain which is E2E encrypted, so would not be revealed with a court order.

> Apple's solution is iCloud Keychain which is E2E encrypted, so would not be revealed with a court order.

Nope. For this threat model, E2E is a complete joke when both E's are controlled by the third party. Apple could be compelled by the government to insert code in the client to upload your decrypted data to another endpoint they control, and you'd never know.

Re: Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

#79

Post by [deleted] »

postalcoder wrote: post #30
Aurornis wrote: post #5

FYI BitLocker is on by default in Windows 11. The defaults will also upload the BitLocker key to a Microsoft Account if available. This is why the FBI can compel Microsoft to provide the keys. It's possible, perhaps even likely, that the suspect didn't even know they had an encrypted laptop. Journalists love the "Microsoft gave " framing because it makes Microsoft sound like they're handing these out because they lik…

I'm not sure how to do this on Windows, but to disable FileVault cloud key backup on Mac, go to `Settings > Users & Groups > click on the (i) tooltip next to your account` and uncheck "Allow user to reset password using Apple Account". This is a part of Settings that you will never see at a passing glance, so it's easy to forget that you may have it on. I'd also like to gently push back against the cynicism expressed…

[deleted]

Re: Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

#80

Post by zer00eyz »

vik0 wrote: post #32
Aurornis wrote: post #5

FYI BitLocker is on by default in Windows 11. The defaults will also upload the BitLocker key to a Microsoft Account if available. This is why the FBI can compel Microsoft to provide the keys. It's possible, perhaps even likely, that the suspect didn't even know they had an encrypted laptop. Journalists love the "Microsoft gave " framing because it makes Microsoft sound like they're handing these out because they lik…

You can always count on someone coming along and defending the multi-trillion dollar corporation that just so happens to take a screenshot of your screen every few seconds (among many, many - too many other things)

https://en.wikipedia.org/wiki/Room_641A ... Then, years later every one acts like Snowden had some big reveal.

There is the old password for candy bar study: https://blog.tmb.co.uk/passwords-for-chocolate

Do users care? I would posit that the bulk of them do not, because they just dont see how it applies to them, till they run into some type of problem.

Post reply on HN