Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

techcrunch.com

Post reply on HN
Print view View original

121–130 of 694 posts

Re: Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

#121

Post by d1sxeyes »

strbean wrote: post #64
tokyobreakfast wrote: post #28

Earlier quoted context omitted.

>even a cosmic ray flipping the "do not upload" bit in memory Stats on this very likely scenario?

> IBM estimated in 1996 that one error per month per 256 MiB of RAM was expected for a desktop computer. From the wikipedia article on "Soft error", if anyone wants to extrapolate.

That makes it vanishingly unlikely. On a 16GB RAM computer with that rate, you can expect 64 random bit flips per month.

So roughly you could expect this happen roughly once every two hundred million years.

Assuming there are about 2 billion Windows computers in use, that’s about 10 computers a year that experience this bit flip.

Re: Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

#122

Post by egorfine »

slashdave wrote: post #31
cogman10 wrote: post #4

> Microsoft told Forbes that the company sometimes provides BitLocker recovery keys to authorities, having received an average of 20 such requests per year. At least they are honest about it, but a good reason to switch over to linux. Particularly if you travel. If microsoft is giving these keys out to the US government, they are almost certainly giving them to all other governments that request them.

Why take the drastic step of switching to linux (a difficult endeavor) when you can simply turn off key uploading.

Because Microsoft absolutely will make it mandatory somewhere in the not so distant future.

Re: Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

#123

Post by dcrazy »

throwway120385 wrote: post #92
Aurornis wrote: post #5

FYI BitLocker is on by default in Windows 11. The defaults will also upload the BitLocker key to a Microsoft Account if available. This is why the FBI can compel Microsoft to provide the keys. It's possible, perhaps even likely, that the suspect didn't even know they had an encrypted laptop. Journalists love the "Microsoft gave " framing because it makes Microsoft sound like they're handing these out because they lik…

Correct me if I'm wrong, but isn't forcing you to divulge your encryption password compelled speech? So the police can crack my phone but they can't force me to tell them my PIN.

Warrants are a mechanism by which speech is legally compelled.

The 5th Amendment gives you the right to refuse speech that might implicate you in a crime. It doesn’t protect Microsoft from being compelled to provide information that may implicate one of its customers in a crime.

Re: Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

#124

Post by al_borland »

egorfine wrote: post #118
ferrouswheel wrote: post #45

It's interesting how many comments these days are like, "well of course". Back in the day hackernews had some fire and resistance. Too many tech workers decided to rollover for the government and that's why we are in this mess now. This isn't an argument about law, it's about designing secure systems. And lazy engineers build lazy key escrow the government can exploit.

> This isn't an argument about law, it's about designing secure systems False. You can design truly end-to-end encrypted secure system and then the state comes at you and says that this is not allowed, period. [1] [1] https://medium.com/@tahirbalarabe2/the-encryption-dilemma-wh...

I'd love to see companies stop service in countries that request things like this, to put pressure on the governments to not be scumbags.

Re: Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

#125

Post by wang_li »

Sayrus wrote: post #88
smegger001 wrote: post #73

Earlier quoted context omitted.

if cosmic ray bit flips were so rare then ecc ram wouldn't be a thing.

ECC protects against more events than cosmic rays. Those events are much more likely, for instance magnetic/electric interferences or chip issues.

In the 2010 era of RAM density, random bit flips were really uncommon. I worked with over a thousand systems which would report ECC errors when they happen and the only memorable events at all were actual DIMM failures.

Also, around 1999-2000, Sun blamed cosmic rays for bit flips for random crashes with their UltraSPARC II CPU modules.

Re: Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

#126

Post by MereInterest »

Aurornis wrote: post #95
drnick1 wrote: post #77

Earlier quoted context omitted.

> Any power users who prefer their own key management should follow the steps to enable Bitlocker without uploading keys to a connected Microsoft account. The real issue is that you can't be sure that the keys aren't uploaded even if you opt out. At this point, the only thing that can restore trust in Microsoft is open sourcing Windows.

> The real issue is that you can't be sure that the keys aren't uploaded even if you opt out. The fully security conscious option is to not link a Microsoft account at all. I just did a Windows 11 install on a workstation (Windows mandatory for some software) and it was really easy to set up without a Microsoft account.

Last time I needed to install Windows 11, avoiding making a Microsoft account required (1) opening a command line to run `oobe/bypassnro`, and (2) skipping past the wifi config screen. While these are quick steps, neither of those are at all "easy", since they require a user to first know that it is an option in the first place.

And newer builds of Windows 11 are removing these methods, to force use of a Microsoft account. [0]

[0] https://www.windowslatest.com/2025/10/07/microsoft-confirms-...

Re: Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

#127

Post by SoftTalker »

Aurornis wrote: post #87
cesarb wrote: post #21

Earlier quoted context omitted.

> Any power users who prefer their own key management should follow the steps to enable Bitlocker without uploading keys to a connected Microsoft account. Once the feature exists, it's much easier to use it by accident. A finger slip, a bug in a Windows update, or even a cosmic ray flipping the "do not upload" bit in memory, could all lead to the key being accidentally uploaded. And it's a silent failure: the securit…

If users are so paranoid that they worry about a cosmic ray bit flipping their computer into betraying them, they're probably not using a Microsoft account at all with their Windows PC.

If your security requirements are such that you need to worry about legally-issued search warrants, you should not connect your computer to the internet. Especially if it's running Windows.

Re: Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

#128

Post by kccqzy »

ferrouswheel wrote: post #45

It's interesting how many comments these days are like, "well of course". Back in the day hackernews had some fire and resistance. Too many tech workers decided to rollover for the government and that's why we are in this mess now. This isn't an argument about law, it's about designing secure systems. And lazy engineers build lazy key escrow the government can exploit.

I don’t see that at all. Instead, I think tech workers, including the engineers and the product managers, are correctly prioritizing user convenience over resistance to government abuse. It’s honestly the right trade off to make. Most users worry about casual criminals, not governments. Say a criminal snatching your laptop and accessing your files that way. If you worry about governments you should already know what to do.

Re: Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

#129

Post by thewebguyd »

Aurornis wrote: post #5

FYI BitLocker is on by default in Windows 11. The defaults will also upload the BitLocker key to a Microsoft Account if available. This is why the FBI can compel Microsoft to provide the keys. It's possible, perhaps even likely, that the suspect didn't even know they had an encrypted laptop. Journalists love the "Microsoft gave " framing because it makes Microsoft sound like they're handing these out because they lik…

> Any power users who prefer their own key management should follow the steps to enable Bitlocker without uploading keys to a connected Microsoft account.

Except the steps to to that are disable bitlocker, create a local user account (assuming you initially signed in with a Microsoft account because Ms now forces it on you for home editions of windows), delete your existing keys from OneDrive, then re-encrypt using your local account and make sure not to sign into your Microsoft account or link it to Windows again.

A much more sensible default would be to give the user a choice right from the beginning much like how Apple does it. When you go through set up assistant on mac, it doesn't assume you are an idiot and literally asks you up front "Do you want to store your recovery key in iCloud or not?"

Post reply on HN