Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

Post by vanviegen » Fri, Jan 23, 2026, 6:53 PM UTC

Aurornis wrote: post #95

drnick1 wrote: post #77

Earlier quoted context omitted.

> Any power users who prefer their own key management should follow the steps to enable Bitlocker without uploading keys to a connected Microsoft account. The real issue is that you can't be sure that the keys aren't uploaded even if you opt out. At this point, the only thing that can restore trust in Microsoft is open sourcing Windows.

> The real issue is that you can't be sure that the keys aren't uploaded even if you opt out. The fully security conscious option is to not link a Microsoft account at all. I just did a Windows 11 install on a workstation (Windows mandatory for some software) and it was really easy to set up without a Microsoft account.

Post by mistercheph » Fri, Jan 23, 2026, 6:54 PM UTC

Aurornis wrote: post #5

FYI BitLocker is on by default in Windows 11. The defaults will also upload the BitLocker key to a Microsoft Account if available. This is why the FBI can compel Microsoft to provide the keys. It's possible, perhaps even likely, that the suspect didn't even know they had an encrypted laptop. Journalists love the "Microsoft gave " framing because it makes Microsoft sound like they're handing these out because they lik…

Post by egorfine » Fri, Jan 23, 2026, 6:55 PM UTC

cesarb wrote: post #21

Aurornis wrote: post #5

FYI BitLocker is on by default in Windows 11. The defaults will also upload the BitLocker key to a Microsoft Account if available. This is why the FBI can compel Microsoft to provide the keys. It's possible, perhaps even likely, that the suspect didn't even know they had an encrypted laptop. Journalists love the "Microsoft gave " framing because it makes Microsoft sound like they're handing these out because they lik…

> Any power users who prefer their own key management should follow the steps to enable Bitlocker without uploading keys to a connected Microsoft account. Once the feature exists, it's much easier to use it by accident. A finger slip, a bug in a Windows update, or even a cosmic ray flipping the "do not upload" bit in memory, could all lead to the key being accidentally uploaded. And it's a silent failure: the securit…

Post by conception » Fri, Jan 23, 2026, 6:56 PM UTC

CodingJeebus wrote: post #85

ferrouswheel wrote: post #45

It's interesting how many comments these days are like, "well of course". Back in the day hackernews had some fire and resistance. Too many tech workers decided to rollover for the government and that's why we are in this mess now. This isn't an argument about law, it's about designing secure systems. And lazy engineers build lazy key escrow the government can exploit.

It’s not about engineers being lazy, it’s about money. Trying to resist building ethically questionable software usually means quitting or being fired from a job.

Post by lanyard-textile » Fri, Jan 23, 2026, 6:57 PM UTC

homebrewer wrote: post #86

tokyobreakfast wrote: post #28

Earlier quoted context omitted.

>even a cosmic ray flipping the "do not upload" bit in memory Stats on this very likely scenario?

Given enough computers, anything will happen. Apparently enough bit flips happen in domains (or their DNS resolution) that registering domains one bit away from the most popular ones (e.g. something like gnogle.com for google.com) might be worth it for bad actors. There was a story a few years ago, but I can't find it right now; perhaps someone will link it.