Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

techcrunch.com

Post reply on HN
Print view View original

281–290 of 694 posts

Re: Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

#281

Post by Spivak »

themafia wrote: post #267
Aurornis wrote: post #5

FYI BitLocker is on by default in Windows 11. The defaults will also upload the BitLocker key to a Microsoft Account if available. This is why the FBI can compel Microsoft to provide the keys. It's possible, perhaps even likely, that the suspect didn't even know they had an encrypted laptop. Journalists love the "Microsoft gave " framing because it makes Microsoft sound like they're handing these out because they lik…

Hacker News defending corporate key escrow. Wow. > It protects their data in the event that someone steals the laptop, but still allows them to recover their own data later from the hard drive. It allows /anyone/ to recover their data later. You don't have to be a "purist" to hate this.

There is no other way for this to work that won't result in an absolutely massive number of people losing their data permanently who had no idea their drive was encrypted. Well there is, leave BitLocker disabled by default and the drive unencrypted. Now the police don't even have to ask!

With this scheme the drive is recoverable by the user and unreadable to everyone except you, Microsoft, and the police. Surely that's a massive improvement over sitting in plaintext readable by the world. The people who are prepared to do proper key management will know how to do it themselves.

Apple does the same thing with FileVault when you set up with your iCloud account where, again, previously your disk was just left unencrypted.

Re: Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

#282

Post by dragonwriter »

thewebguyd wrote: post #177
zdragnar wrote: post #135

Earlier quoted context omitted.

I can't believe it took this long. We have mandatory identification for all kinds of things that are illegal to purchase or engage in under a certain age. Nobody wants to prosecute 12 year old kids for lying when the clicked the "I am at least 13 years old" checkbox when registering an account. The only alternative is to do what we do with R-rated movies, alcohol, tobacco, firearms, risky physical activities (i.e. bu…

The problem is the implementation is hasty. When I go buy a beer at the gas station, all I do is show my ID to the cashier. They look at it to verify DOB and then that's it. No information is stored permanently in some database that's going to get hacked and leaked. We can't trust every private company that now has to verify age to not store that information with whatever questionable security. If we aren't going to…

> If we aren't going to do a national registry that services can query to get back only a "yes or no" on whether a user is of age or not

And note that if we are, the records of the request to that database are an even bigger privacy timebomb than those of any given provider, just waiting for malicious actors with access to government records.

Re: Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

#283

Post by dragonwriter »

criddell wrote: post #239
thewebguyd wrote: post #177

Earlier quoted context omitted.

The problem is the implementation is hasty. When I go buy a beer at the gas station, all I do is show my ID to the cashier. They look at it to verify DOB and then that's it. No information is stored permanently in some database that's going to get hacked and leaked. We can't trust every private company that now has to verify age to not store that information with whatever questionable security. If we aren't going to…

> When I go buy a beer at the gas station, all I do is show my ID to the cashier. They look at it to verify DOB and then that's it. No information is stored permanently in some database that's going to get hacked and leaked. Beer, sure. But if you buy certain decongestants, they do log your ID. At least that's the case in Texas.

> But if you buy certain decongestants, they do log your ID.

Yeah, but many people don't actually think War on Drugs policies are a model for civil liberties that should be extended beyond that domain (or, in many cases, even tolerated in that domain.) That policy has been effective, I guess, in promoting the sales of alternative “decongestants” (that don't actually work), though it did little to curb use and harms from the drugs it was supposed to control by attacking supply.

Re: Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

#284

Post by fpoling »

thewebguyd wrote: post #129
Aurornis wrote: post #5

FYI BitLocker is on by default in Windows 11. The defaults will also upload the BitLocker key to a Microsoft Account if available. This is why the FBI can compel Microsoft to provide the keys. It's possible, perhaps even likely, that the suspect didn't even know they had an encrypted laptop. Journalists love the "Microsoft gave " framing because it makes Microsoft sound like they're handing these out because they lik…

> Any power users who prefer their own key management should follow the steps to enable Bitlocker without uploading keys to a connected Microsoft account. Except the steps to to that are disable bitlocker, create a local user account (assuming you initially signed in with a Microsoft account because Ms now forces it on you for home editions of windows), delete your existing keys from OneDrive, then re-encrypt using y…

With Bitlocker it is still possible to have single password-based key. But enabling that requires to enter a few commands on the command line.

Re: Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

#285

Post by b65e8bee43c2ed0 »

Aurornis wrote: post #5

FYI BitLocker is on by default in Windows 11. The defaults will also upload the BitLocker key to a Microsoft Account if available. This is why the FBI can compel Microsoft to provide the keys. It's possible, perhaps even likely, that the suspect didn't even know they had an encrypted laptop. Journalists love the "Microsoft gave " framing because it makes Microsoft sound like they're handing these out because they lik…

>The defaults will also upload the BitLocker key to a Microsoft Account if available.

>This is why the FBI can compel Microsoft to provide the keys.

>in my opinion it's the reasonable default

I really can't imagine what kind of person would say that with a straight face. Hanlon's razor be damned, I have to ask: are you a Microsoft employee or investor?

Re: Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

#286

Post by jbstack »

taberiand wrote: post #250
SmellTheGlove wrote: post #169

Earlier quoted context omitted.

I’ll bite. What Linux distro currently has the nicest desktop experience? I work on a MacBook but my desktop is a windows PC that I use for gaming and personal projects. I hear Proton has made the former pretty good now, and the latter is mostly in WSL for me anyway. Maybe a good time to try. What do you suggest? I’ll try it in a VM or live usb.

If you're a developer, try NixOS. The code based configuration can be daunting but LLMs are very good at writing it.

Not sure it's good as a starter distro, but other than that I agree. I was put off NixOS for a long time despite loving the principles behind it. Then a few weeks ago I had ChatGPT give me a short course on it, including flakes and the basics of the Nix language. I completed that in a few hours and achieved more than I ever had reading the Nix docs and blogs etc. Now I'm able to use an LLM to help me write flakes while also understanding what it is doing (I'm not a fan of blindly using AI generated code).

Re: Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

#287

Post by [deleted] »

dgrunwald wrote: post #189
thewebguyd wrote: post #129

Earlier quoted context omitted.

> Any power users who prefer their own key management should follow the steps to enable Bitlocker without uploading keys to a connected Microsoft account. Except the steps to to that are disable bitlocker, create a local user account (assuming you initially signed in with a Microsoft account because Ms now forces it on you for home editions of windows), delete your existing keys from OneDrive, then re-encrypt using y…

> make sure not to sign into your Microsoft account or link it to Windows again That's not so easy. Microsoft tries really hard to get you to use a Microsoft account. For example, logging into MS Teams will automatically link your local account with the Microsoft account, thus starting the automatic upload of all kinds of stuff unrelated to MS Teams. In the past I also had Edge importing Firefox data (including store…

[deleted]

Re: Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

#288

Post by blipvert »

wolvoleo wrote: post #35
bigyabai wrote: post #12

Earlier quoted context omitted.

If by "power user" you mean "enemy of the state", there's a lot of software you'd be better-off avoiding.

"enemy of the state" depends a lot on the current state of the state. Eg in England you're already an enemy of the state when you protest against Israel's actions in Gaza. In America if you don't like civilians being executed by ICE. This is really a bad time to throw "enemy of the state" around as if this only applies to the worst people. Current developments are the ideal time to show that these powers can be abuse…

Very much hyperbolic about the UK. You’re fine protesting against Israel, but Palestine Action is a proscribed group (not that I agree with that!) and that will land you in trouble.

Re: Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

#289

Post by bnjms »

NegativeK wrote: post #266
t-3 wrote: post #159

Earlier quoted context omitted.

If you design it so you don't have access to the data, how do you make money? Microsoft (and every other corporation) wants your data. They don't want to be a responsible custodian of your data, they want to sell it and use it for advertising and maintaining good relationships with governments around the world.

> If you design it so you don't have access to the data, how do you make money? The same way companies used to make money, before they started bulk harvesting of data and forcing ads into products that we're _already_ _paying_ _for_? I wish people would have integrity instead of squeezing out every little bit of profit from us they can.

People arguably cannot have integrity unless all other companies they compete with also have integrity. The answer is legislation. We have no reason to allow our government to use “private” companies to do what they cannot then turn over the results to government agencies. Especially when willfully incompetence.

The same can be said of using “allies” to mutually snoop on citizens then turning over data.

Re: Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

#290

Post by Spivak »

ferrouswheel wrote: post #45

It's interesting how many comments these days are like, "well of course". Back in the day hackernews had some fire and resistance. Too many tech workers decided to rollover for the government and that's why we are in this mess now. This isn't an argument about law, it's about designing secure systems. And lazy engineers build lazy key escrow the government can exploit.

This is such a lazy take and ignores that this is the only system that has the property of not losing data when users forget their passwords and lose (or likely never write down) their recovery key.

That's it. That's the whole thing. Whatever "secure system" you build will not have this property and users will lose their data, be mad at you, and eventually you'll have to turn it off by default leaving everyone's data in plaintext. It's a compromise that improves security for people who previously left their disk unencrypted. It changes nothing for people who previously did their own key management.

You won't be able to turn the first group into the second group. That's HN's "Average Familiarity" fallacy. The fact that basically every 2FA system has a means of recovering your account by removing it should tell you that even technical people are shit at key management.

Post reply on HN