Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security researcher says Microsoft built a Bitlocker backdoor, releases exploit

techspot.com

Post reply on HN
Print view View original

31–40 of 280 posts

Re: Security researcher says Microsoft built a Bitlocker backdoor, releases exploit

#31

Post by mynameisvlad »

superkuh wrote: post #27
mynameisvlad wrote: post #22

Earlier quoted context omitted.

The non-cloud methods for recovering the key have been the same since Bitlocker was released 19 years ago. https://support.microsoft.com/en-us/windows/find-your-bitloc...

I think there's been some miscommunication. If the bitlocker activation happens during tricking the user into going from a local account to online account, it is without the user's consent or real participation. They haven't printed out a copy of the key or moved it to a usb drive. They aren't aware their drives are being encrypted. They can't set up recovery keys now because the computer itself only shows the blue a…

You can set up recovery keys at any point in time, not just at creation. Just because people don't do it doesn't mean it isn't and hasn't been available for almost 2 decades.

Re: Security researcher says Microsoft built a Bitlocker backdoor, releases exploit

#32

Post by markant »

"Security professionals generally recommend avoiding reliance on any single encryption system and instead evaluating well-reviewed full-disk encryption alternatives such as VeraCrypt".

If they put a backdoor into FDE it would make more sense to advise people to stop using windows at all and using Linux instead. If they put a backdoor in FDE you can be sure there is not just one backdoor in the operating system itself. You shouldn't trust proprietary software at all. You shouldn't even trust open source if it isn't properly audited.

Re: Security researcher says Microsoft built a Bitlocker backdoor, releases exploit

#33

Post by Alifatisk »

embedding-shape wrote: post #18

Seems this traces back almost a week, from Nightmare-Eclipse who is the researcher who found this: Tuesday, 12 May 2026 - "Here are the links, yes, two vulnerabilities this time [YellowKey] [GreenPlasma] [...] Next patch tuesday will have a big surprise for you Microsoft" Wednesday, 13 May 2026 - "I can't wait when I will be allowed to disclose the full story, I think people will find my crashout very reasonable and…

Can’t wait to read the blogpost of what have truly happened and motivated this person to expose M$ like this

Re: Security researcher says Microsoft built a Bitlocker backdoor, releases exploit

#34

Post by treis »

The_President wrote: post #21
NBJack wrote: post #14

Earlier quoted context omitted.

Are you saying you bring your desktop on a train ride as well? Laptops with encryption make sense; if you need to encrypt your desktop, I have questions.

Simple hypothetical: "A disaster hits and the workstation owner is unable to return to the location the workstation is stored. During that time period the workstation is stolen by a gang of looters."

Ah yes a typical Tuesday for me

Re: Security researcher says Microsoft built a Bitlocker backdoor, releases exploit

#35

Post by gruez »

microtonal wrote: post #15
seanieb wrote: post #11

At what point will Security professionals start turning down roles that involve “securing” MS Products? I’m already at this point. Securing Microsoft products is busy work while waiting to have it undercut by the next wave of MS’s insane tech debt and greed. And now backdoors!

As opposed to iOS, which does iCloud backups that are not E2E encrypted by default, so that law enforcement can request your chats (except Signal because they opt out), browser history, etc.? You can enable ADP for E2E encrypted backups, but it's probable not going to help you much, because the people you are communicating with likely didn't. This is not to defend Microsoft, more to say that all these companies were…

>You can enable ADP for E2E encrypted backups, but it's probable not going to help you much, because the people you are communicating with likely didn't.

That just sounds like a fundamental issue with security in general, not specific to Apple/Microsoft.

Re: Security researcher says Microsoft built a Bitlocker backdoor, releases exploit

#36

Post by tptacek »

markant wrote: post #32

"Security professionals generally recommend avoiding reliance on any single encryption system and instead evaluating well-reviewed full-disk encryption alternatives such as VeraCrypt". If they put a backdoor into FDE it would make more sense to advise people to stop using windows at all and using Linux instead. If they put a backdoor in FDE you can be sure there is not just one backdoor in the operating system itself…

I don't use Microsoft products generally but not with even with your computer would I run VeraCrypt.

Re: Security researcher says Microsoft built a Bitlocker backdoor, releases exploit

#37

Post by JoshTriplett »

msh wrote: post #20
NBJack wrote: post #14

Earlier quoted context omitted.

Are you saying you bring your desktop on a train ride as well? Laptops with encryption make sense; if you need to encrypt your desktop, I have questions.

Burglars are a thing.

Also a reason to have off-site backups. Many people have done backups to local servers, only to discover that they have no way to recover their data because thieves stole everything.

Re: Security researcher says Microsoft built a Bitlocker backdoor, releases exploit

#38

Post by hiq »

archerx wrote: post #4

Maybe I’m an outlier but I don’t want my drives encrypted at all. I rather have all my data be accessible if things go catastrophic, I.E. having to pull the drive out of a broken computer and put it in another computer to access the files. I just want it to be plug and play.

If "things go catastrophic" your hard drive is not usable at all anymore. At the very least some files can't be recovered at all. So you need backups in any case. Once you have backups, you might as well encrypt your hard drives, especially if you store these in different locations (which you should).

An advantage of encryption is that it makes it easier to give away or resell devices. With recent encryption schemes (well the ones on Linux, given this article), I feel confident that overwriting the encryption keys gets me close enough to not leaking my data once I get rid of an old hard drive.

Re: Security researcher says Microsoft built a Bitlocker backdoor, releases exploit

#39

Post by alamortsubite »

BLKNSLVR wrote: post #19

Title sounds conspiratorial, but it lines up well with the controversy around TrueCrypt's discontinuation which, I believe, specifically called out BitLocker as an alternative to use in future.

You're probably thinking of VeraCrypt, which is a fork of TrueCrypt. I don't think BitLocker is related.

Re: Security researcher says Microsoft built a Bitlocker backdoor, releases exploit

#40

Post by akersten »

ekjhgkejhgk wrote: post #26
BLKNSLVR wrote: post #19

Title sounds conspiratorial, but it lines up well with the controversy around TrueCrypt's discontinuation which, I believe, specifically called out BitLocker as an alternative to use in future.

I'm not aware of the connection between truecrypt and bitlocker, want to enlighten us?

Long time ago TrueCrypt suddenly and abruptly shut down with a vague goodbye message saying "everyone please move on and use bitlocker instead"

Prevailing theory is they were pressured to put in a backdoor and couldn't disclose it, so they had to make a seemingly ridiculous statement (because who in their right mind would trust bitlocker) to call attention that "something is very wrong"

Post reply on HN