Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft will give the FBI a Windows PC data encryption key if ordered

windowscentral.com

Post reply on HN
Print view View original

191–200 of 346 posts

Re: Microsoft will give the FBI a Windows PC data encryption key if ordered

#191

Post by deadbabe »

Zak wrote: post #140

The headline is misleading. It says that Microsoft will provide the key if asked , but the linked statement to Forbes says Microsoft will provide the key if it receives a valid legal order . These have different meanings. Microsoft is legally entitled to refuse a request from law enforcement, and subject to criminal penalties if it refuses a valid legal order. It does illustrate a significant vulnerability in that Mi…

In a society where laws don’t mean anything “valid legal orders” can quickly be drafted up even if not legal.

Re: Microsoft will give the FBI a Windows PC data encryption key if ordered

#192

Post by bigyabai »

cedws wrote: post #33
_blk wrote: post #29

Earlier quoted context omitted.

Thanks, that's good to know. I suspect WhatsApp's "we're fully E2E encrypted" would be similar too.

It's most software. Cryptography is user-unfriendly. The mechanisms used to make it user friendly sacrifice security. There's a saying that goes "not your keys not your crypto" but this really extends to everything. If you don't control the keys something else does behind the scenes. A six digit PIN you use to unlock your phone or messaging app doesn't have enough entropy to be secure, even to derive a key-encryption…

Take it a step further, even - "End-to-End-Encryption" is complete security theater if the user doesn't control either end.

We joke and say that maybe Microsoft could engineer a safer architecture, but they can also ship an OTA update changing the code ad-hoc. If the FBI demands cooperation from Microsoft, can they really afford to say "no" to the feds? The architecture was busted from the ground-up for the sort of cryptographic expectations most people have.

Re: Microsoft will give the FBI a Windows PC data encryption key if ordered

#193

Post by Retric »

runjake wrote: post #166
0x262d wrote: post #149

Earlier quoted context omitted.

Is it meaningfully misleading? How often is this an obstacle for the FBI?

Yes, "asked" versus "ordered" is meaningfully misleading, especially in this context. There is reasonable suspicion, some might argue evidence, that Microsoft voluntarily cooperated with U.S. Intelligence Community without being compelled by a court order, the most famous instances being leaked in the Snowden disclosures. To be fair to Microsoft, here's their updated statement (emphasis mine): "Microsoft confirmed to…

You’ve overly simplified the degree to which a company must accept a court order without pushback.

First they are capable of fulfilling the request in the first place which means their approach or encryption is inherently flawed. Second companies can very much push back on such requests with many examples of such working, but they need to make the attempt.

Re: Microsoft will give the FBI a Windows PC data encryption key if ordered

#194

Post by morshu9001 »

fc417fc802 wrote: post #170
morshu9001 wrote: post #153

Earlier quoted context omitted.

Google has a pretty robust recovery process. Of course if you've given them absolutely nothing about them then forgotten your password, it's tough.

As long as the automated flow works everything is great. But if the music stops can you get in touch with a human to fix it? That applies not just to auth but pretty much all of their stuff. Plenty of horror stories have made it to the HN front page over the years.

I've had to get in touch with a human before for account recovery, it worked. Horror stories, idk. I hear horror stories about every single business I interact with, but then don't experience it myself.

Re: Microsoft will give the FBI a Windows PC data encryption key if ordered

#195

Post by pocksuppet »

xp84 wrote: post #133
wobfan wrote: post #69

Earlier quoted context omitted.

While you're right, they also went out of their way to prevent competent users from using local accounts and/or not upload their BitLocker keys. I could understand if the default is an online account + automatic key upload, but only if you add an opt-out option to it. It might not even be visible by default, like, idk, hide it somewhere so that you can be sure that the median MS user won't see it and won't think abou…

I really doubt those motives are "evil." They're in the business of selling and supporting an OS. Most people couldn't safeguard a 10-byte password on their own, they're not going to have a solution for saving their encryption key that keeps it safer than it'd be with Microsoft, and that goes for both criminals (or people otherwise facing law enforcement scrutiny) and normal grandmas who just want to not have all the…

[dead]

Re: Microsoft will give the FBI a Windows PC data encryption key if ordered

#197

Post by jeroenhd »

cornholio wrote: post #60
hermanzegerman wrote: post #51

Earlier quoted context omitted.

They could just ask before uploading your encryption key to the cloud. Instead they force people to use a Microsoft Account to set up their windows and store the key without explicit consent

That's a crypto architecture design choice, MS opted for the user-friendly key escrow option instead of the more secure strong local key - that requires a competent user setting a strong password and saving recovery codes, understanding the disastrous implication of a key loss etc. Given the abilities of the median MS client, the better choice is not obvious at all, while "protecting from a nation-state adversary" wa…

They could still have asked. They do if you enable Bitlocker outside of the OOBE.

This story is just yet another confirmation of what used to be the "the americans have bugged most computers in the world" conspiracy theory.

I hope Microsoft wakes up to the changes in the way America is being viewed these days, because they stand to lose a lot of business if they don't.

Re: Microsoft will give the FBI a Windows PC data encryption key if ordered

#198

Post by jeroenhd »

JasonADrury wrote: post #85
hermanzegerman wrote: post #51

Earlier quoted context omitted.

They could just ask before uploading your encryption key to the cloud. Instead they force people to use a Microsoft Account to set up their windows and store the key without explicit consent

The alternative is just not having FDE on by default, it really isn't "require utterly clueless non-technical users to go through complicated opt-in procedure for backups to avoid losing all their data when they forget their password". And AFAICT, they do ask, even if the flow is clearly designed to get the user to back up their keys online.

Phones have had FDE enabled by default for years. Nobody needs backup keys for those.

Of course this feature comes at the cost of no longer being able to have low level control over your device, but this isn't a binary choice.

Re: Microsoft will give the FBI a Windows PC data encryption key if ordered

#199

Post by Forgeties79 »

bdangubic wrote: post #188
Forgeties79 wrote: post #186

Earlier quoted context omitted.

> The headline is misleading. It says that Microsoft will provide the key if asked , but the linked statement to Forbes says Microsoft will provide the key if it receives a valid legal order . This is an odd thing to split hairs over IMO. Warrants or subpoenas or just asking nicely, whatever bar you want to set, is a secondary concern. The main issue is they can and will hand the keys to LEO’s at all.

The even-more-main-issue is that there is > 0 number of people who thought they wouldn’t

I appreciate the sentiment and do think most people should know not to trust Microsoft by this point, but I do think we have to be a little careful not to steer too hard into caveat emptor and forget who the perpetrators are in the first place.

Re: Microsoft will give the FBI a Windows PC data encryption key if ordered

#200

Post by JohnTHaller »

Zak wrote: post #140

The headline is misleading. It says that Microsoft will provide the key if asked , but the linked statement to Forbes says Microsoft will provide the key if it receives a valid legal order . These have different meanings. Microsoft is legally entitled to refuse a request from law enforcement, and subject to criminal penalties if it refuses a valid legal order. It does illustrate a significant vulnerability in that Mi…

Note that they say "legal order" not, specifically, "warrant". Now remember that government agencies have internal memos instructing them that no warrants are needed for them to do things like the 4th amendment, stop citizens, detain citizens, "arrest" citizens, etc.
Post reply on HN