Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security researcher says Microsoft built a Bitlocker backdoor, releases exploit

techspot.com

Post reply on HN
Print view View original

41–50 of 280 posts

Re: Security researcher says Microsoft built a Bitlocker backdoor, releases exploit

#41

Post by MrZander »

tptacek wrote: post #36
markant wrote: post #32

"Security professionals generally recommend avoiding reliance on any single encryption system and instead evaluating well-reviewed full-disk encryption alternatives such as VeraCrypt". If they put a backdoor into FDE it would make more sense to advise people to stop using windows at all and using Linux instead. If they put a backdoor in FDE you can be sure there is not just one backdoor in the operating system itself…

I don't use Microsoft products generally but not with even with your computer would I run VeraCrypt.

What? Why?

Re: Security researcher says Microsoft built a Bitlocker backdoor, releases exploit

#42

Post by recursivegirth »

tptacek wrote: post #36
markant wrote: post #32

"Security professionals generally recommend avoiding reliance on any single encryption system and instead evaluating well-reviewed full-disk encryption alternatives such as VeraCrypt". If they put a backdoor into FDE it would make more sense to advise people to stop using windows at all and using Linux instead. If they put a backdoor in FDE you can be sure there is not just one backdoor in the operating system itself…

I don't use Microsoft products generally but not with even with your computer would I run VeraCrypt.

Ever since the TrueCrypt fiasco years ago, I have no trust in that brand.

Re: Security researcher says Microsoft built a Bitlocker backdoor, releases exploit

#44

Post by cindyllm »

The_President wrote: post #21
NBJack wrote: post #14

Earlier quoted context omitted.

Are you saying you bring your desktop on a train ride as well? Laptops with encryption make sense; if you need to encrypt your desktop, I have questions.

Simple hypothetical: "A disaster hits and the workstation owner is unable to return to the location the workstation is stored. During that time period the workstation is stolen by a gang of looters."

[dead]

Re: Security researcher says Microsoft built a Bitlocker backdoor, releases exploit

#45

Post by microtonal »

gruez wrote: post #35
microtonal wrote: post #15

Earlier quoted context omitted.

As opposed to iOS, which does iCloud backups that are not E2E encrypted by default, so that law enforcement can request your chats (except Signal because they opt out), browser history, etc.? You can enable ADP for E2E encrypted backups, but it's probable not going to help you much, because the people you are communicating with likely didn't. This is not to defend Microsoft, more to say that all these companies were…

>You can enable ADP for E2E encrypted backups, but it's probable not going to help you much, because the people you are communicating with likely didn't. That just sounds like a fundamental issue with security in general, not specific to Apple/Microsoft.

My point is that these defaults that look secure to a non-expert, but do not hold up to scrutiny, are probably intentional.

I have found that even many tech people have incorrect beliefs about these things, like assuming that iCloud Backups are E2E encrypted by default or that disabling Allow Apps to Request to Track disables trackers inside apps.

Re: Security researcher says Microsoft built a Bitlocker backdoor, releases exploit

#46

Post by deng »

archerx wrote: post #4

Maybe I’m an outlier but I don’t want my drives encrypted at all. I rather have all my data be accessible if things go catastrophic, I.E. having to pull the drive out of a broken computer and put it in another computer to access the files. I just want it to be plug and play.

But it's also plug&play for anyone stealing your laptop, see for instance

https://news.ycombinator.com/item?id=39941021

Re: Security researcher says Microsoft built a Bitlocker backdoor, releases exploit

#47

Post by Glohrischi »

NBJack wrote: post #14
Glohrischi wrote: post #6

Earlier quoted context omitted.

My harddrives (laptop, work laptop, desktop, server) contain emails, browser sessions, saved passwords, personal data from family and friends. I do not want someone stealing my laptop on a train ride potentially being able to have all of that data. With a proper real backup strategy, i have everything save. I do not need easy access to a hard drive from a broken computer. But hey you do you :)

Are you saying you bring your desktop on a train ride as well? Laptops with encryption make sense; if you need to encrypt your desktop, I have questions.

I have one safety concept for everything and not random ones for random devices.

Every machine is encrypted, unlocked per login.

Encryption is basically free so.

Re: Security researcher says Microsoft built a Bitlocker backdoor, releases exploit

#48

Post by Glohrischi »

xingped wrote: post #13
Glohrischi wrote: post #6

Earlier quoted context omitted.

My harddrives (laptop, work laptop, desktop, server) contain emails, browser sessions, saved passwords, personal data from family and friends. I do not want someone stealing my laptop on a train ride potentially being able to have all of that data. With a proper real backup strategy, i have everything save. I do not need easy access to a hard drive from a broken computer. But hey you do you :)

Cool. Everyone's threat model is different. As long as we're not writing passwords on sticky notes attached to the monitor, I don't think there's any need to be throwing stones.

I did not throw a stone, i only clarified my counter position for others to understand why I encrypt.

Re: Security researcher says Microsoft built a Bitlocker backdoor, releases exploit

#49

Post by rokkamokka »

recursivegirth wrote: post #42
tptacek wrote: post #36

Earlier quoted context omitted.

I don't use Microsoft products generally but not with even with your computer would I run VeraCrypt.

Ever since the TrueCrypt fiasco years ago, I have no trust in that brand.

Fiasco? You mean where they voluntarily shut down rather than compromise themselves? Or are you referring to another matter?

Re: Security researcher says Microsoft built a Bitlocker backdoor, releases exploit

#50

Post by microtonal »

seanieb wrote: post #24
microtonal wrote: post #15

Earlier quoted context omitted.

As opposed to iOS, which does iCloud backups that are not E2E encrypted by default, so that law enforcement can request your chats (except Signal because they opt out), browser history, etc.? You can enable ADP for E2E encrypted backups, but it's probable not going to help you much, because the people you are communicating with likely didn't. This is not to defend Microsoft, more to say that all these companies were…

> This is not to defend Microsoft But you are defending MS, conflating a bunch of things, mainly full disk encryption and cloud backups. There's a big difference between Apples cloud backup which has documented behavior and a backdoor. I'm also fairly confidant in Apple's full disk encryption, they've gone to court to defend it. There also a lot more data points we can use to judge Apple vs Microsoft on privacy and s…

I think my message wooshed. I was not comparing disk encryption and iCloud backups. My point is that insecure defaults are Apple and other's alternative to backdoors. They give plausible deniability ("how is someone able to recover their data if they lost their credentials and we used E2E?"), while at the same time satisfying law enforcement, because the vast majority of people is not aware of them.

Another example is WhatsApp on Android, by default when backups are enabled, they are stored unencrypted in Google Drive. A good counter-example is Signal, which opts out of backups on iOS and Android and the only option is to do E2E backups to their own servers.

I'm also fairly confidant in Apple's full disk encryption, they've gone to court to defend it.

FWIW, in the last leaked report, iPhone was not an issue AFU for Cellebrite (macOS is most likely even easier due to looser security):

https://discuss.grapheneos.org/d/14344-cellebrite-premium-ju...

Post reply on HN