Live data from Hacker News

Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

techcrunch.com

531–540 of 694 posts

Re: Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

#531
post #5

FYI BitLocker is on by default in Windows 11. The defaults will also upload the BitLocker key to a Microsoft Account if available. This is why the FBI can compel Microsoft to provide the keys. It's possible, perhaps even likely, that the suspect didn't even know they had an encrypted laptop. Journalists love the "Microsoft gave " framing because it makes Microsoft sound like they're handing these out because they lik…

> Any power users who prefer their own key management should follow the steps to enable Bitlocker without uploading keys to a connected Microsoft account. Except the steps to to that are disable bitlocker, create a local user account (assuming you initially signed in with a Microsoft account because Ms now forces it on you for home editions of windows), delete your existing keys from OneDrive, then re-encrypt using y…

> delete your existing keys from OneDrive

This seems to go against principles of key management. If your key escrow peer has defected, the correct response is to rotate your keys.

Re: Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

#532

Earlier quoted context omitted.

At Microsoft-scale, data requests from law enforcement are an inevitability. Designing a system such that their requests are answerable is a choice. Signal's cloud backup system is an example of a different choice being made.

^^^ This

Please omit internet tropes on HN.

https://news.ycombinator.com/newsguidelines.html

Re: Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

#533
post #97

Earlier quoted context omitted.

At google "more than 8% of DIMM memory modules were affected by errors per year" [0] More on the topic: Single-event upset[1] [0] https://en.wikipedia.org/wiki/ECC_memory [1] https://en.wikipedia.org/wiki/Single-event_upset

> At google "more than 8% of DIMM memory modules were affected by errors per year" That's all errors including permanent hardware failure, not just transient bit flips or from cosmic rays.

You are right. Apologies for spreading false information(

"We provide strong evidence that memory errors are dominated by hard errors, rather than soft errors, which previous work suspects to be the dominant error mode." [0]

"Memory errors can be caused by electrical or magnetic interference (e.g. due to cosmic rays), can be due to problems with the hardware (e.g. a bit being permanently damaged), or can be the result of corruption along the data path between the memories and the processing elements. Memory errors can be classified into soft errors, which randomly corrupt bits but do not leave physical damage; and hard errors, which corrupt bits in a repeatable manner because of a physical defect."

"Conclusion 7: Error rates are unlikely to be dominated by soft errors.

We observe that CE [correctable errors] rates are highly correlated with system utilization, even when isolating utilization effects from the effects of temperature. In systems that do not use memory scrubbers this observation might simply reflect a higher detection rate of errors. In systems with memory scrubbers, this observations leads us to the conclusion that a significant fraction of errors is likely due to mechanism other than soft errors, such as hard errors or errors induced on the datapath. The reason is that in systems with memory scrubbers the reported rate of soft errors should not depend on utilization levels in the system. Each soft error will eventually be detected (either when the bit is accessed by an application or by the scrubber), corrected and reported. Another observation that supports Conclusion 7 is the strong correlation between errors in the same DIMM. Events that cause soft errors, such as cosmic radiation, are expected to happen randomly over time and not in correlation.

Conclusion 7 is an interesting observation, since much previous work has assumed that soft errors are the dominating error mode in DRAM. Some earlier work estimates hard errors to be orders of magnitude less common than soft errors and to make up about 2% of all errors."

[0] https://www.cs.toronto.edu/~bianca/papers/sigmetrics09.pdf

Re: Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

#534
post #4

> Microsoft told Forbes that the company sometimes provides BitLocker recovery keys to authorities, having received an average of 20 such requests per year. At least they are honest about it, but a good reason to switch over to linux. Particularly if you travel. If microsoft is giving these keys out to the US government, they are almost certainly giving them to all other governments that request them.

Why take the drastic step of switching to linux (a difficult endeavor) when you can simply turn off key uploading.

you've baked in an unfounded assumption that bitlocker is even initially enabled intentionally by someone who knows that's a choice they can make:

> Here's what happens on your Dell computer:

> BitLocker turns on automatically when you first set up Windows 10 or Windows 11

> It works quietly in the background, you won't notice it's there

> Your computer creates a special recovery key (like a backup password) that's saved to your Microsoft account

> You might be reading this article because:

> Your computer is asking for a BitLocker recovery key

...such as after your laptop resets its tpm randomly which is often the first time many people learn their disk is encrypted and that there's a corresponding recovery key in their microsoft account for the data they are now unexpectedly locked out of.

https://www.dell.com/support/kbdoc/el-gr/000124701/automatic...

Re: Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

#535
post #5

FYI BitLocker is on by default in Windows 11. The defaults will also upload the BitLocker key to a Microsoft Account if available. This is why the FBI can compel Microsoft to provide the keys. It's possible, perhaps even likely, that the suspect didn't even know they had an encrypted laptop. Journalists love the "Microsoft gave " framing because it makes Microsoft sound like they're handing these out because they lik…

> Any power users who prefer their own key management should follow the steps to enable Bitlocker without uploading keys to a connected Microsoft account. Except the steps to to that are disable bitlocker, create a local user account (assuming you initially signed in with a Microsoft account because Ms now forces it on you for home editions of windows), delete your existing keys from OneDrive, then re-encrypt using y…

If I wanted privacy that couldn’t be broken by Microsoft I wouldn’t be using OneDrive.

I would be using an operating system that wasn’t geared up to be cloud backed up and closed source.

Re: Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

#536
post #276

Earlier quoted context omitted.

That's not the point. Microsoft shouldn't be silently taking your encryption key in the first place. The law doesn't compel them to do that.

It's not silent. It tells you when you set up BitLocker and it also allows you to recover the drive.

[deleted]

Re: Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

#537

Hear that? It's the sound of the year of the Linux desktop. It's time - it's never been easier, and there's nothing you'll miss about Windows.

I've been trying to get my parents to move, but until Microsoft Office desktop is able to be run natively on there my parents won't entertain the subject. I've tried to get them to use the web version of office, I've tried to get them to use OnlyOffice and LibreOffice, I've even tried showing them LaTeX as a last ditch effort, but no, if it isn't true Microsoft Branded Office 2024, the topic isn't even worth discussi…

I recently helped my GF by proofreading something she wrote, which is a primarily Hebrew (RTL) Word document with English terms like units, numbers, and unpronouncable chemical names sprinkled in.

If I had a dollar for every time MS Word failed to correctly handle the BIDI mix and put things in the wrong order, despite me reapeatedly trying different ways to fix it, I'd be richer than Microsoft.

On the contrary, Google Docs, LibreOffice, and pretty much every text box outside of MS Office can effortlessly handle BIDI mixing, all thanks the Unicode Bidirectional Algorithm [1] being widely implemented ans standardized.

[1] https://unicode.org/reports/tr9/

Re: Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

#538

It's interesting how many comments these days are like, "well of course". Back in the day hackernews had some fire and resistance. Too many tech workers decided to rollover for the government and that's why we are in this mess now. This isn't an argument about law, it's about designing secure systems. And lazy engineers build lazy key escrow the government can exploit.

They rolled over to the money, not the government.

Re: Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

#539
post #5

FYI BitLocker is on by default in Windows 11. The defaults will also upload the BitLocker key to a Microsoft Account if available. This is why the FBI can compel Microsoft to provide the keys. It's possible, perhaps even likely, that the suspect didn't even know they had an encrypted laptop. Journalists love the "Microsoft gave " framing because it makes Microsoft sound like they're handing these out because they lik…

[dead]

Re: Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

#540

I think it is the kind of right place to ask: Is it possible to encrypt the system disc after Linux was installed or so I have to reinstall Linux for that purpose?

https://wiki.archlinux.org/title/Dm-crypt/Device_encryption#...
Post reply on HN