Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft will give the FBI a Windows PC data encryption key if ordered

windowscentral.com

Post reply on HN
Print view View original

281–290 of 346 posts

Re: Microsoft will give the FBI a Windows PC data encryption key if ordered

#281

Post by digiown »

winstonwinston wrote: post #211
Intermernet wrote: post #115

Earlier quoted context omitted.

This is a bit tricky as it couples the user's password with the disk encryption key. If a user changes the password they would then need to change the encryption key, or remember the previous (possibly compromised) password. A better option is to force the user to record a complex hash, but that's never going to be user friendly when it comes to the average computer user. Basically, we need better education about the…

The system handles these changes for the user automatically. The disk key is encrypted by user password, when user changes the password, the system completes disk key rollover automatically. Which means it will decrypt key with old password and then encrypt key with new password.

Windows also allows you to reset your user password via Microsoft, which complicates things a little

Re: Microsoft will give the FBI a Windows PC data encryption key if ordered

#282

Post by digiown »

bdavbdav wrote: post #81
ExoticPearTree wrote: post #75

Earlier quoted context omitted.

Encrypt the BL key with the user's password? I mean there are a lot of technical solutions besides "we're gonna keep the BL keys in the clear and readily available for anyone".

I thought this was what happened. Clearly not :( That’s the idea with services like 1Password (which I suppose is ultimately doing the same thing) - you need both the key held on the device and the password. I suppose this all falls apart when the PC unlock password is your MS account password, the MS account can reset the local password. In Mac OS / Linux, you reset the login password, you loose the keychain.

On Linux the typical LUKS setup is entirely separate from the login password. You don't lose anything if you forget the login password. You can just reset it with a live USB or similar.

If you mean the secure boot auto-unlock type of setup and you don't have a key backup, then you cannot reset your login password at all. You have to wipe the drive.

Re: Microsoft will give the FBI a Windows PC data encryption key if ordered

#283

Post by seemaze »

Spooky23 wrote: post #165
Zak wrote: post #140

The headline is misleading. It says that Microsoft will provide the key if asked , but the linked statement to Forbes says Microsoft will provide the key if it receives a valid legal order . These have different meanings. Microsoft is legally entitled to refuse a request from law enforcement, and subject to criminal penalties if it refuses a valid legal order. It does illustrate a significant vulnerability in that Mi…

Nah, you’re just not reading carefully. You must parse everything about this stuff carefully as the words are always crafted. It’s usually more productive to read with a goal to understand what isn’t said as opposed to what is said. They said “legal order”, which includes a variety of things ranging from administrative subpoenas to judicial warrants. Generally they say warrant if that was used. A “request” is “Hi Mic…

>the article states that Microsoft only gets 20 a year, and is responsive to 9 or fewer requests. Apple seems to get more and typically is more responsive.

That just makes me think that Windows is generally less secure and there are likely a larger number of instances where the AHJ doesn't have to request help from Microsoft to access the data.

Re: Microsoft will give the FBI a Windows PC data encryption key if ordered

#284

Post by bobmcnamara »

1718627440 wrote: post #267
Zak wrote: post #140

The headline is misleading. It says that Microsoft will provide the key if asked , but the linked statement to Forbes says Microsoft will provide the key if it receives a valid legal order . These have different meanings. Microsoft is legally entitled to refuse a request from law enforcement, and subject to criminal penalties if it refuses a valid legal order. It does illustrate a significant vulnerability in that Mi…

> Microsoft is legally entitled to refuse a request from law enforcement, and subject to criminal penalties if it refuses a valid legal order. This is a problem, because Microsoft operates in a lot of jurisdictions, but one of them always wants to be the exception and claims that it has jurisdiction over all the others. Not that I personally am of the opinion, that it is wise for the other jurisdiction to trust Micro…

Or maybe not stash everybody's keys?

Re: Microsoft will give the FBI a Windows PC data encryption key if ordered

#285

Post by TeMPOraL »

Dylan16807 wrote: post #274
morshu9001 wrote: post #156

Earlier quoted context omitted.

Google Authenticator used to be disconnected from reality like this. Users were asking how to copy the codes to another phone, and they said "you can't, WAI, should add the other phone as a second auth method on every site." Like how people say you shouldn't copy SSH privkeys. I figured out an undocumented way to do it on iPhone by taking an encrypted iTunes backup though. Eventually they yielded on this, but their l…

On the security versus convenience spectrum, allowing a user backup and taking an automatic corporate backup are far apart. Yes you should do the former. That doesn't say much about the latter.

Except nobody wants to allow users to make backups themselves.

Or maybe I missed something, and there is actually a way to download your phone backup from Google, or PC backup from Microsoft, as actual files you can browse, without having to have a sacrificial device to wipe and restore from backup?

Re: Microsoft will give the FBI a Windows PC data encryption key if ordered

#286

Post by TeMPOraL »

DmitryO wrote: post #145
Zak wrote: post #140

The headline is misleading. It says that Microsoft will provide the key if asked , but the linked statement to Forbes says Microsoft will provide the key if it receives a valid legal order . These have different meanings. Microsoft is legally entitled to refuse a request from law enforcement, and subject to criminal penalties if it refuses a valid legal order. It does illustrate a significant vulnerability in that Mi…

The same way you cannot be sure that FBI is not criminals

It's a catchy meme for sure, but when people actually start to believe - like for real, not just the usual talking shit that passes for "conversation" with normal people - that law enforcement officers are worse thugs than regular thugs -- that's a fast way to turn into a failed state, where that actually is true.

Causality here actually works both ways, because in free(ish) societies, law enforcement derives its authority more from people's intersubjective belief in that authority, and less from actual use of force.

Re: Microsoft will give the FBI a Windows PC data encryption key if ordered

#287

Post by TeMPOraL »

seemaze wrote: post #283
Spooky23 wrote: post #165

Earlier quoted context omitted.

Nah, you’re just not reading carefully. You must parse everything about this stuff carefully as the words are always crafted. It’s usually more productive to read with a goal to understand what isn’t said as opposed to what is said. They said “legal order”, which includes a variety of things ranging from administrative subpoenas to judicial warrants. Generally they say warrant if that was used. A “request” is “Hi Mic…

>the article states that Microsoft only gets 20 a year, and is responsive to 9 or fewer requests. Apple seems to get more and typically is more responsive. That just makes me think that Windows is generally less secure and there are likely a larger number of instances where the AHJ doesn't have to request help from Microsoft to access the data.

Apple has a long history of automatically uploading (and/or "backing up") all documents and media of its customers to iCloud. Microsoft started doing that with OneDrive and OneDrive backups only recently. That + the work Apple put in locking down its phone from users and attackers alike, basically breaks down like this:

                 | Apple         | Microsoft  |
  ---------------+---------------+------------|
  Users with     | approximately | small but  |
  data in cloud  | everyone      | growing    |
  ---------------+---------------+------------|
  Access to      | denied via    | easily     |
  data on device | cryptography  | available  |
                 | by default    | by default |

Re: Microsoft will give the FBI a Windows PC data encryption key if ordered

#288

Post by TeMPOraL »

mossTechnician wrote: post #174
Zak wrote: post #140

The headline is misleading. It says that Microsoft will provide the key if asked , but the linked statement to Forbes says Microsoft will provide the key if it receives a valid legal order . These have different meanings. Microsoft is legally entitled to refuse a request from law enforcement, and subject to criminal penalties if it refuses a valid legal order. It does illustrate a significant vulnerability in that Mi…

Crucially, the headline says Microsoft will provide the key if asked by the FBI , which implies a state entity with legal power that extends beyond a typical person's assumptions of "rule of law" and "due process," let alone ethics.

Typical person assumes that FBI is chasing aliens (from outer space) and hardened criminals so bad the local police can't handle them. At least that's what American TV teaches us.

Now CIA, on the other hand, ... well, they won't need to ask for the crypto keys anyway.

Re: Microsoft will give the FBI a Windows PC data encryption key if ordered

#290

Post by TeMPOraL »

aprentic wrote: post #190
xp84 wrote: post #151

Earlier quoted context omitted.

> tradeoff between security and convenience they'd certainly have far fewer customers What? Most people, thinking through the tradeoff, would 100% not choose to be in charge of safeguarding their own key, because they're more worried about losing everything on their PC, than they are about going to jail. Because most people aren't planning on doing crime. Yes, I know people can be wrongly accused and stuff, but overa…

That's exactly what I mean. If you tell people, "I'll take care of safeguarding your key for you," it sounds like you're just doing them a favor. It would be more honest to say, "I can hold on to a copy of your key and automatically unlock your data when we think you need it opened," but that would make it too obvious that they might do so without your permission.

They're not doing them a favor. They're providing them a service.

Trust is a fundamental aspect of how the world works. It's a feature, not a bug.

Consider that e.g. your car mechanic, or domestic service (if you employ it), or housekeeping in hotel you stay, all have unsupervised access to some or all of your critical information and hardware. Yet, these people are not seen as threat actors by most people, because we trust them to not abuse that access, and we know there are factors at play to ensure that trust.

In this context, I see Microsoft as belonging to the cohort above for most people. Both MS and your house cleaner will turn over your things to police should they come knocking, but otherwise you can trust them to not snoop through your stuff with malicious intent. And if you don't trust them enough - don't buy their services.

Post reply on HN