Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

techcrunch.com

Post reply on HN
Print view View original

231–240 of 694 posts

Re: Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

#231

Post by jcalvinowens »

ezfe wrote: post #219
jcalvinowens wrote: post #78

Earlier quoted context omitted.

> Apple's solution is iCloud Keychain which is E2E encrypted, so would not be revealed with a court order. Nope. For this threat model, E2E is a complete joke when both E's are controlled by the third party. Apple could be compelled by the government to insert code in the client to upload your decrypted data to another endpoint they control, and you'd never know.

Yeah and Microsoft could insert code to upload the bitlocker keys. What's your point? Even linux could do that if they were compelled to.

> Even linux could do that if they were compelled to.

An open source project absolutely cannot do that without your consent if you build your client from the source. That's my point.

Re: Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

#233

Post by estimator7292 »

My Linux drives are all encrypted, and one of the wonderful features of this is that there is no entity or force on this planet that can decrypt them.

What happens if I forget my keys? Same thing that happens if my computer gets struck by a meteor. New drive, new key, restore contents from backups.

It's simple, secure, set-and-forget, and absolutely nobody but me and your favored deity have any idea what's on my drives. Microsoft and the USGov don't have any business having access to my files, and it's completely theoretically impossible for them to gain access within the next few decades.

Don't use Windows. Use a secure operating system. Windows is not security for you, it's security for a hostile authoritarian government.

Re: Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

#234

Post by xp84 »

thewebguyd wrote: post #177
zdragnar wrote: post #135

Earlier quoted context omitted.

I can't believe it took this long. We have mandatory identification for all kinds of things that are illegal to purchase or engage in under a certain age. Nobody wants to prosecute 12 year old kids for lying when the clicked the "I am at least 13 years old" checkbox when registering an account. The only alternative is to do what we do with R-rated movies, alcohol, tobacco, firearms, risky physical activities (i.e. bu…

The problem is the implementation is hasty. When I go buy a beer at the gas station, all I do is show my ID to the cashier. They look at it to verify DOB and then that's it. No information is stored permanently in some database that's going to get hacked and leaked. We can't trust every private company that now has to verify age to not store that information with whatever questionable security. If we aren't going to…

We should easily be able to, but the problem of tech illiteracy is probably our main barrier. To build such a system you’d need to issue those credentials to the end users. Those users in turn would eagerly believe conspiracy theories that the digital ID system was actually stealing their data or making it available to MORE parties instead of fewer (compared to using those ID verification services we have today).

Re: Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

#235

Post by shakna »

shawnz wrote: post #205
thewebguyd wrote: post #129

Earlier quoted context omitted.

> Any power users who prefer their own key management should follow the steps to enable Bitlocker without uploading keys to a connected Microsoft account. Except the steps to to that are disable bitlocker, create a local user account (assuming you initially signed in with a Microsoft account because Ms now forces it on you for home editions of windows), delete your existing keys from OneDrive, then re-encrypt using y…

Why would you need to create a local account? You can just not choose to store the keys in your Microsoft account during BitLocker setup: https://www.diskpart.com/screenshot/en/others/windows-11/win... Admittedly, the risks of choosing this option are not clearly laid out, but the way you are framing it also isn't accurate

All "Global Reader" accounts have "microsoft.directory/bitlockerKeys/key/read" permission.

Whether you opt in, or not, if you connect your account to Microsoft, then they do have the ability fetch the bitlocker key, if the account is not local only. [0] Global Reader is builtin to everything +365.

[0] https://github.com/MicrosoftDocs/entra-docs/commit/2364d8da9...

Re: Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

#236

Post by Retr0id »

Aurornis wrote: post #5

FYI BitLocker is on by default in Windows 11. The defaults will also upload the BitLocker key to a Microsoft Account if available. This is why the FBI can compel Microsoft to provide the keys. It's possible, perhaps even likely, that the suspect didn't even know they had an encrypted laptop. Journalists love the "Microsoft gave " framing because it makes Microsoft sound like they're handing these out because they lik…

At Microsoft-scale, data requests from law enforcement are an inevitability. Designing a system such that their requests are answerable is a choice. Signal's cloud backup system is an example of a different choice being made.

Re: Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

#237

Post by modeless »

thewebguyd wrote: post #222
modeless wrote: post #185

Earlier quoted context omitted.

They don't do that for iMessage though... https://james.darpinian.com/blog/apple-imessage-encryption

Only because others you communicate with may not have ADP turned on, which is a flaw with any service that you cannot control what the other end does or does not do, not unique to Apple/iMessage outside of using something like Signal.

Most other E2EE messaging services do not break their own E2EE by intentionally uploading messages or encryption keys to servers owned by the same company in a form that they can read. For example, Google's Messages app does not do this for E2EE conversations. This isn't something that only Signal cares about.

Re: Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

#238

Post by ssl-3 »

LtdJorge wrote: post #192
dgrunwald wrote: post #189

Earlier quoted context omitted.

> make sure not to sign into your Microsoft account or link it to Windows again That's not so easy. Microsoft tries really hard to get you to use a Microsoft account. For example, logging into MS Teams will automatically link your local account with the Microsoft account, thus starting the automatic upload of all kinds of stuff unrelated to MS Teams. In the past I also had Edge importing Firefox data (including store…

Teams inside a VM it is, then.

Or: Put all of Windows inside of a VM, within a host that uses disk encryption -- and let it run amok inside of its sandbox.

I did this myself for about 8 years, from 2016-2024. During that time my desktop system at home was running Linux with ZFS and libvirt, with Windows in a VM. That Windows VM was my usual day-to-day interface for the entire system. It was rocky at first, but things did get substantially better as time moved on. I'll do it again if I have a compelling reason to.

Re: Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

#239

Post by criddell »

thewebguyd wrote: post #177
zdragnar wrote: post #135

Earlier quoted context omitted.

I can't believe it took this long. We have mandatory identification for all kinds of things that are illegal to purchase or engage in under a certain age. Nobody wants to prosecute 12 year old kids for lying when the clicked the "I am at least 13 years old" checkbox when registering an account. The only alternative is to do what we do with R-rated movies, alcohol, tobacco, firearms, risky physical activities (i.e. bu…

The problem is the implementation is hasty. When I go buy a beer at the gas station, all I do is show my ID to the cashier. They look at it to verify DOB and then that's it. No information is stored permanently in some database that's going to get hacked and leaked. We can't trust every private company that now has to verify age to not store that information with whatever questionable security. If we aren't going to…

> When I go buy a beer at the gas station, all I do is show my ID to the cashier. They look at it to verify DOB and then that's it. No information is stored permanently in some database that's going to get hacked and leaked.

Beer, sure. But if you buy certain decongestants, they do log your ID. At least that's the case in Texas.

Re: Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

#240

Post by p0w3n3d »

ferrouswheel wrote: post #45

It's interesting how many comments these days are like, "well of course". Back in the day hackernews had some fire and resistance. Too many tech workers decided to rollover for the government and that's why we are in this mess now. This isn't an argument about law, it's about designing secure systems. And lazy engineers build lazy key escrow the government can exploit.

yeah, every time someone says 'good, government must protect us from terrorists', they need to remember that sometimes

  govt := new_govt
  terrorist := you
Post reply on HN