Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft will give the FBI a Windows PC data encryption key if ordered

windowscentral.com

Post reply on HN
Print view View original

211–220 of 346 posts

Re: Microsoft will give the FBI a Windows PC data encryption key if ordered

#211

Post by winstonwinston »

Intermernet wrote: post #115
ExoticPearTree wrote: post #75

Earlier quoted context omitted.

Encrypt the BL key with the user's password? I mean there are a lot of technical solutions besides "we're gonna keep the BL keys in the clear and readily available for anyone".

This is a bit tricky as it couples the user's password with the disk encryption key. If a user changes the password they would then need to change the encryption key, or remember the previous (possibly compromised) password. A better option is to force the user to record a complex hash, but that's never going to be user friendly when it comes to the average computer user. Basically, we need better education about the…

The system handles these changes for the user automatically. The disk key is encrypted by user password, when user changes the password, the system completes disk key rollover automatically. Which means it will decrypt key with old password and then encrypt key with new password.

Re: Microsoft will give the FBI a Windows PC data encryption key if ordered

#212

Post by blackcatsec »

ViktorRay wrote: post #172
blackcatsec wrote: post #169

Earlier quoted context omitted.

Firstly, Apple does not refuse such requests. In fact, it was very widely publicized in the past couple of weeks that Apple has removed Advanced Data Protection for users in the UK. So while US users still enjoy Advanced Data Protection from Apple, UK users do not. It is entirely possible that Apple's Advanced Data Protection feature is removed legally by the US as well, if the regime decides they want to target it.…

You seem to be forgetting the time the Obama administration asked Apple to unlock a suspect’s iPhone and Apple refused.

That was before Tim Cook presented Donald Trump with a gold and glass plaque along with a Mac Pro.

We live in far different times these days. I have no doubt in my mind that Apple is complying 100% with every LE request coming their way (not only because of the above gesture, but because it's actually the law)

Re: Microsoft will give the FBI a Windows PC data encryption key if ordered

#213

Post by vardalab »

jmward01 wrote: post #162

Actual freedom starts with freedom of thought which requires spaces that you can truly believe are safe. The push for the surveillance world is rapidly eroding the places someone can not only be safe to think but feel safe to think in. The 'feel safe' is deeply important here. The arguments of 'if you have nothing to hide' do not make anyone feel safe, they do the opposite and they chill free thought. The second, ver…

Exactly! I agree about feeling free to think is important. I am a legal immigrant here on the green card, and I was randomly looking at my iCloud photos, and there were two of them where I was wearing a 2024 elections t-shirt of the losing side. The t-shirt was given to me as a gag gift, and I just had taken a picture of it to show it to the sender for giggles. Now looking at this old image. I had second thoughts. What if on the border crossing some officer sees a t-shirt and doesn't agree with it? Maybe I should delete the image. And it's not the first time I want to go post something online, but I've stopped myself. What if it comes back and bites me? Even though it might be an innocuous tweet, nothing egregious, but I just don't want to engage. And this is how freedom goes. This feels as bad as it was growing up in the Soviet Union.

Re: Microsoft will give the FBI a Windows PC data encryption key if ordered

#214

Post by Zak »

Retric wrote: post #193
runjake wrote: post #166

Earlier quoted context omitted.

Yes, "asked" versus "ordered" is meaningfully misleading, especially in this context. There is reasonable suspicion, some might argue evidence, that Microsoft voluntarily cooperated with U.S. Intelligence Community without being compelled by a court order, the most famous instances being leaked in the Snowden disclosures. To be fair to Microsoft, here's their updated statement (emphasis mine): "Microsoft confirmed to…

You’ve overly simplified the degree to which a company must accept a court order without pushback. First they are capable of fulfilling the request in the first place which means their approach or encryption is inherently flawed. Second companies can very much push back on such requests with many examples of such working, but they need to make the attempt.

I don't think it's reasonable to expect businesses to spend money fighting court orders for customer data, especially if the orders are more or less reasonable.

They do seem to be reasonable in the case that brought about this reporting, with substantial evidence that the suspects committed fraud and that evidence is on the devices in question.

Re: Microsoft will give the FBI a Windows PC data encryption key if ordered

#215

Post by winstonwinston »

Palmik wrote: post #206

Does Microsoft let you encrypt the key with your password / passphrase (with a backup you can write down)?

Technically it is possible to configure butlocker using passphrase instead of a TPM. It is not easy though. It is configured via GPO. However it is not a local account password. It is a separate passphrase which you need to provide early in boot process, similar to LUKS on linux systems. It works on windows computers without TPM, i’m not sure is it supported on systems that actually have TPM available.

Re: Microsoft will give the FBI a Windows PC data encryption key if ordered

#216

Post by pregnenolone »

I’m not trying to defend Microsoft, but I think people are being a bit dramatic. It's a fairly reasonable default setting for average users who simply want their data protected from theft. On the other hand, users should be able to opt out from the outset, and above all, without having to fiddle with the manage-bde CLI or group policy settings.

With Intel Panther Lake (I'm not sure about AMD), Bitlocker will be entirely hardware-accelerated using dedicated SoC engines – which is a huge improvement and addresses many commonly known Full Disk Encryption vulnerabilities. However, in my opinion some changes still need to be made, particularly for machines without hardware acceleration support:

- Let users opt out of storing recovery keys online during setup.

- Let users choose between TPM or password based FDE during setup and let them switch between those options without forcing them to deal with group policies and the CLI.

- Change the KDF to a memory-hard KDF - this is important for both password and PIN protected FDE. It's 2026 - we shouldn't be spamming SHA256 anymore.

- Remove the 20 char limit from PIN protectors and make them alphanumerical by default. Windows 11 requires TPM 2.0 anyway so there's no point in enforcing a 20 char limit.

- Enable TPM parameter encryption for the same reasons outlined above.

Re: Microsoft will give the FBI a Windows PC data encryption key if ordered

#217

Post by notepad0x90 »

maxglute wrote: post #152
notepad0x90 wrote: post #148

I don't understand this, it's actually baffling. Why was the question being asked to begin with let along a whole post being made about this? If they have a legal request from a law enforcement agency of any country they operate in, they either comply or see executives in prison. Is how bitlocker works not well known perhaps? I don't think it's a secret. The whole schtick is that you get to manage windows computers i…

>Microsoft would do the same in China, Europe, middle east,etc.. the FBI isn't special. One would presume US agencies has leverage to access global data.

Sure, I don't disagree but that isn't what this discussion is about. It's about a lawful publicized request. For microsoft, they don't need any leverages, they can just use a FISA order, they can force you to keep it a secret. Their leverage is federal prison.

Re: Microsoft will give the FBI a Windows PC data encryption key if ordered

#218

Post by gosub100 »

Forgeties79 wrote: post #186
Zak wrote: post #140

The headline is misleading. It says that Microsoft will provide the key if asked , but the linked statement to Forbes says Microsoft will provide the key if it receives a valid legal order . These have different meanings. Microsoft is legally entitled to refuse a request from law enforcement, and subject to criminal penalties if it refuses a valid legal order. It does illustrate a significant vulnerability in that Mi…

> The headline is misleading. It says that Microsoft will provide the key if asked , but the linked statement to Forbes says Microsoft will provide the key if it receives a valid legal order . This is an odd thing to split hairs over IMO. Warrants or subpoenas or just asking nicely, whatever bar you want to set, is a secondary concern. The main issue is they can and will hand the keys to LEO’s at all.

I hate MS as much as anyone else, but I don't have a problem with them doing this. Legally they have to comply if they have evidence in a legal action. Maybe they are at fault for not solely relying on the TPM, or not giving users informed consent about using the cloud, but I cannot fault them for not going to battle for civil liberties when they can't even implement notepad without screwing it up.

Re: Microsoft will give the FBI a Windows PC data encryption key if ordered

#219

Post by hinkley »

pregnenolone wrote: post #216

I’m not trying to defend Microsoft, but I think people are being a bit dramatic. It's a fairly reasonable default setting for average users who simply want their data protected from theft. On the other hand, users should be able to opt out from the outset, and above all, without having to fiddle with the manage-bde CLI or group policy settings. With Intel Panther Lake (I'm not sure about AMD), Bitlocker will be entir…

If you don’t think Intel put back doors into that then I fear for the future.

Re: Microsoft will give the FBI a Windows PC data encryption key if ordered

#220

Post by hinkley »

Zak wrote: post #140

The headline is misleading. It says that Microsoft will provide the key if asked , but the linked statement to Forbes says Microsoft will provide the key if it receives a valid legal order . These have different meanings. Microsoft is legally entitled to refuse a request from law enforcement, and subject to criminal penalties if it refuses a valid legal order. It does illustrate a significant vulnerability in that Mi…

I’m sure there was a time in my life I would have taken those two sentences to mean the same thing but that time is long past.
Post reply on HN