Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft will give the FBI a Windows PC data encryption key if ordered

windowscentral.com

Post reply on HN
Print view View original

111–120 of 346 posts

Re: Microsoft will give the FBI a Windows PC data encryption key if ordered

#111

Post by dmurray »

cornholio wrote: post #60
hermanzegerman wrote: post #51

Earlier quoted context omitted.

They could just ask before uploading your encryption key to the cloud. Instead they force people to use a Microsoft Account to set up their windows and store the key without explicit consent

That's a crypto architecture design choice, MS opted for the user-friendly key escrow option instead of the more secure strong local key - that requires a competent user setting a strong password and saving recovery codes, understanding the disastrous implication of a key loss etc. Given the abilities of the median MS client, the better choice is not obvious at all, while "protecting from a nation-state adversary" wa…

Protecting from a nation state adversary should probably be a goal for the kind of enterprise software MS sells.

Protecting from specifically the nation state that hosts and regulates Microsoft and its biggest clients, probably not.

Re: Microsoft will give the FBI a Windows PC data encryption key if ordered

#112

Post by AnthonyMouse »

cornholio wrote: post #88
jMyles wrote: post #57

Earlier quoted context omitted.

> Do we really, really, fully understand the implication of allowing private contracts that trump criminal law? ...it's not that at all. We don't want private contracts to enshrine the same imbalances of power; we want those imbalances rendered irrelevant. We hope against hope that people who have strength, money, reputation, legal teams, etc., will be as steadfast in asserting basic rights as people who have none of…

I think legally the issue was adjudicated by analogy to a closed safe: while the exact contents of the safe is unknown beforehand, it is reasonable it will contain evidence, documents, money, weapons etc. that are relevant, so if a warrant can be issued in that case compelling a locksmith to open it, then by analogy it can be issued against an encrypted device. Without doubt, this analogy surely breaks down as societ…

> so if a warrant can be issued in that case compelling a locksmith to open it, then by analogy it can be issued against an encrypted device.

But it isn't a warrant, it's a subpoena. Also, the locksmith isn't the one compelled to open it; if the government wants someone to do that they have to pay them.

> Any written constitution is just a snapshot of a social contract at a particular historical time and technological development point, so it cannot serve as the ultimate source of truth regarding individual rights - the contract is renegotiated constantly through political means.

The Fourth Amendment was enacted in 1791. A process to change it exists, implying that the people could change it if they wanted to, but sometimes they get it pretty right to begin with. And then who are these asshats craving access to everyone's "papers and effects" without a warrant?

Re: Microsoft will give the FBI a Windows PC data encryption key if ordered

#113

Post by bad_haircut72 »

p_ing wrote: post #82
bdavbdav wrote: post #79

Earlier quoted context omitted.

Disagree. If the path is shrouded behind key presses and commands which are unpublished by MS (and in some instances routes that have been closed), it may as well be.

> it may as well be. That defies the definition of "forced". Forced means no option. You can disagree all you want -- but at a technical level, you're incorrect.

Im going to shoot you unless you say the magic word - and technically Im not even forcing you into it, you could have said the magic word and got out of it!! Whats the magic word? not telling!

Re: Microsoft will give the FBI a Windows PC data encryption key if ordered

#114

Post by Vaslo »

sandworm101 wrote: post #40
shoknawe wrote: post #4

Veracrypt https://veracrypt.io/en/Home.html

https://linuxmint.com/ https://ubuntu.com/download/desktop https://archlinux.org/ https://www.kali.org/get-kali/#kali-platforms https://fedoraproject.org/ Every bad day for microsoft is yet another glorious day for linux.

To people on HN considering the switch, maybe. My family has zero interest or intention of trying any of these. It stops with me.

Re: Microsoft will give the FBI a Windows PC data encryption key if ordered

#115

Post by Intermernet »

ExoticPearTree wrote: post #75
cornholio wrote: post #45

Beyond the crypto architecture debate, I don't really understand how could anyone imagine a world where MS could just refuse such a request. How exactly would we draft laws to this effect, "the authorities can subpoena for any piece of evidence, except when complying to such a request might break the contractual obligations of a third party towards the suspect"? Do we really, really, fully understand the implications…

Encrypt the BL key with the user's password? I mean there are a lot of technical solutions besides "we're gonna keep the BL keys in the clear and readily available for anyone".

This is a bit tricky as it couples the user's password with the disk encryption key. If a user changes the password they would then need to change the encryption key, or remember the previous (possibly compromised) password. A better option is to force the user to record a complex hash, but that's never going to be user friendly when it comes to the average computer user.

Basically, we need better education about the issue, but as this is the case with almost every contentious issue in the world right now, I can't imagine this particular issue will bubble to the top of the awareness heap.

Re: Microsoft will give the FBI a Windows PC data encryption key if ordered

#116

Post by B1FIDO »

arielcostas wrote: post #90
ExoticPearTree wrote: post #75

Earlier quoted context omitted.

Encrypt the BL key with the user's password? I mean there are a lot of technical solutions besides "we're gonna keep the BL keys in the clear and readily available for anyone".

At this point, end-to-end encryption is a solved problems when password managers exist. Not doing it means either Microsoft doesn't care enough, or is actually interested on keeping it this way

I wouldn't call the problem "solved" just because of password managers.

Password managers shift the paradigm and the risk factors. In terms of MFA, a password in your manager is now "something you have" rather than "something you know". The only password I know nowadays is my sign-in password that unlocks the password manager's vault. So the passwords to my bank, my health care, my video games are no longer "in my fingers" or in my head anymore, they're unknown to me!

So vault management becomes the issue rather than password management. If passwords are now "something you have" then it becomes possible to lose them. For example, if my home burns down and I show up in a public library with nothing but the clothes on my back, how do I sign into my online accounts? If the passwords were in my fingers, I could do this. But if they require my smartphone to be operational and charged and having network access, and also require passwords I don't know anymore, I'm really screwed at that library. It'd be nearly impossible for me to sign back in.

So in the days of MFA and password managers, now we need to manage the vaults, whether they're in the cloud or in local storage, and we also need to print out recovery codes on paper and store them securely somewhere physical that we can access them after a catastrophe. This is an increase in complexity.

So I contend that password managers, and their cousins the nearly-ubiquitous passkeys, are the main driving factor in people's forgetting their passwords and forgetting how to sign-in now, without relying on an app to do it for them. And that is a decrease in opsec for consumers.

Re: Microsoft will give the FBI a Windows PC data encryption key if ordered

#117

Post by kube-system »

GeekyBear wrote: post #74
cromka wrote: post #8

Any reason to believe Apple won't do the same with whatever we backup in iCloud?

Any American company will hand over data stored on their server (that they have access to) in response to a warrant. Apple provides an optional encryption level (ADP) where they don't have a copy of your encryption key. When Apple doesn't have the encryption key, they can't decrypt your data, so they can't provide a copy of the decrypted data in response to a warrant. They explain the trade off during device setup: I…

Any company in any country will hand over data in response to a warrant. There is no country with a higher standard of protection than a warrant.

Re: Microsoft will give the FBI a Windows PC data encryption key if ordered

#118

Post by rvnx »

selfhoster11 wrote: post #93
p_ing wrote: post #82

Earlier quoted context omitted.

> it may as well be. That defies the definition of "forced". Forced means no option. You can disagree all you want -- but at a technical level, you're incorrect.

Try doing this as a normies without technical guidance. Technically correct, this time, is not the benchmark.

Anyway Microsoft and any software developer can be compelled to practically do anything, you don't want to be blocked in some jurisdictions (even less the US) and the managers do not want to go to jail to protect a terrorist, especially if nobody is going to know that they helped.

Some even go that far that they push an update that exfiltrates data from a device (and some even do on their own initiative).

And even if you are not legally compelled. Money or influence can go a long way. For example, the fact that HTTPS communications were decipherable by the NSA for almost 20 years, or, whoops, no contract with DoD ("not safe enough"...)

Once the data is in the hands of the intelligence services, from a procedure perspective they can choose what to do next (e.g. to officialize this data collection through physical collection of the device, or do nothing and try to find a more juicy target).

It's not in the interest of anyone to prevent such collection agreement with governments. It's just Prism v2.

So seems normal that Microsoft gives the keys, the same that Cloudflare may give information about you and the others. They don't want to have their lives ruined for you.

Re: Microsoft will give the FBI a Windows PC data encryption key if ordered

#120

Post by varispeed »

wobfan wrote: post #69
cornholio wrote: post #60

Earlier quoted context omitted.

That's a crypto architecture design choice, MS opted for the user-friendly key escrow option instead of the more secure strong local key - that requires a competent user setting a strong password and saving recovery codes, understanding the disastrous implication of a key loss etc. Given the abilities of the median MS client, the better choice is not obvious at all, while "protecting from a nation-state adversary" wa…

While you're right, they also went out of their way to prevent competent users from using local accounts and/or not upload their BitLocker keys. I could understand if the default is an online account + automatic key upload, but only if you add an opt-out option to it. It might not even be visible by default, like, idk, hide it somewhere so that you can be sure that the median MS user won't see it and won't think abou…

Maybe three letter agencies prevented them from giving that option.
Post reply on HN