Live data from Hacker News

Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

techcrunch.com

601–610 of 694 posts

Re: Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

#601
post #90

Earlier quoted context omitted.

> It protects their data in the event that someone steals the laptop, but still allows them to recover their own data later from the hard drive. False. If you only put the keys on the Microsoft account, and Microsoft closes your account for whatever reason, you are done.

Yes if someone steals your laptop at the same moment Microsoft bans you you're done . What's the likelyhood of that happening? done here meaning you've lost your data which uhhh, is currently on a drive in the hands of thieves, so what did you lose again?

I think you are confused.

The issue is about getting locked out of your own data, which can easily happen in a number of cases.

And you don't necessarily need to actually have your account banned.

Let's just say you signed up for a Microsoft account when setting up for a new PC (well, because you have to). You don't use that account anywhere else, and you forgot the password, even though you can log in via PIN or something else. Now you install Linux or just boot to a different system once. When you need to boot to Windows again, good luck.

And that's just one of the cases.

A real disaster happened to someone, although on a different platform, and the context is a bit different: https://hey.paris/posts/appleid/

Re: Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

#602

My Linux drives are all encrypted, and one of the wonderful features of this is that there is no entity or force on this planet that can decrypt them. What happens if I forget my keys? Same thing that happens if my computer gets struck by a meteor. New drive, new key, restore contents from backups. It's simple, secure, set-and-forget, and absolutely nobody but me and your favored deity have any idea what's on my driv…

Obligatory XKCD https://xkcd.com/538

[dead]

Re: Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

#603

Earlier quoted context omitted.

Why take the drastic step of switching to linux (a difficult endeavor) when you can simply turn off key uploading.

Microsoft is known for regularly altering the deal. Just because you configure the OS to not upload keys today, does not mean that setting will be respected in the future.

Pray I don’t alter it further.

Re: Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

#604
I honestly love how HN is missing the forest for the trees, here, in the sense that ya’ll are upset Microsoft gave keys over for BitLocker to the feds but seemingly forget that Microsoft has been doing this in various forms since BitLocker released. Hell, they’ve given alphabet agencies tools that just pop the decryption in the field before, for intelligence work.

I trust BitLocker and Apple’s encryption to protect my stuff against snooping thieves, but I have never, ever assumed for a moment that it’d protect me against a nation-state, and neither should you. All the back-and-forth you see in the media is just what’s public drama, and a thin veil of what’s actually going on behind the scenes.

If there’s stuff you don’t want a nation state to see, it better be offline, on a OSS OS, encrypted with thoroughly audited and properly configured security tooling. Even then, you’re more likely to end up in jail for refusing to decrypt it [1][2].

[1] https://arstechnica.com/tech-policy/2020/02/man-who-refused-...

[2] https://www.vice.com/en/article/how-refusing-to-hand-over-yo...

Re: Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

#605
post #280

Earlier quoted context omitted.

The defenders of Microsoft are right? How? There is no point locking your laptop with a passphrase if that passphrase is thrown around. Sure, maybe some thief can't get access, but they probably can if they can convince Microsoft to hand over the key. Microsoft should not have the key, thats part of the whole point of FDE; nobody can access your drive except you. The cost of this is that if you lose your key: you als…

Just to be clear: bitlocker is NOT encrypting with your login password! I could be a little fuzzy on the details but I believe how it works is that your TPM (Trusted Platform Module) is able to decrypt your laptop, but will only do so if there is a fully signed and trusted boot chain, so if somebody gains access to your laptop and attempts to boot into anything other than Windows, it will ask for the bitlocker key be…

BitLocker encrypts data on a disk using what it calls a Full Volume Encryption Key (FVEK).[1][2] This FVEK is encrypted with a separate key which it calls a Volume Management Key (VMK) and the VMK-encrypted FVEK is stored in one to three (for redundancy) metadata blocks on the disk.[1][2] The VMK is then encrypted with one or more times with a key which is derived/stored using one or more methods which are identified with VolumeKeyProtectorID.[2][3] These methods include what I think would now be the default for modern Windows installations of 3 "Numerical password" (128-bit recovery key formatted with checksums) and 4 "TPM And PIN". Previously instead of 4 "TPM And PIN" most Windows installations (without TPMs forced to be used) would probably be using just 8 "Passphrase". Unless things have changed recently, in mode 4 "TPM And PIN", the TPM stores a partial key, and the PIN supplied by the user is the other partial key, and both partial keys are combined together to produce the key used to decrypt the VMK.

Seemingly once you've installed Windows and given the Microsoft your BitLocker keys in escrow, you could then use Remove-BitLockerKeyProtector to delete the VMK which is protected with mode 3 "Numerical password" (recovery key).[4] It appears that the escrow process (possibly the same as used by BackupToAAD-BitLockerKeyProtector) might only send the numerical key, rather than the VMK itself.[5][6] I couldn't find from a quick Internet search someone who has reverse engineered fveskybackup.dll to confirm this is the case though. If Microsoft are sending the VMK _and_ the numerical key, then they have everything needed to decrypt a disk. If Microsoft are only sending the numerical key, and all numerical key protected VMKs are later securely erased from the disk, the numerical key they hold in escrow wouldn't be useful later on.

Someone did however ask the same question I first had. What if I had, for example, a billion BitLocker recovery keys I wanted to ensure were backed up for my protection, safety and peace of mind? This curious person did however already know the limit was 200 recovery keys per device, and found out re-encryption would fail if this limit had been reached, then realised Microsoft had fixed this bug by adding a mechanism to automatically delete stale recovery keys in escrow, then reverse engineered fveskybackup.dll and an undocumented Microsoft Graph API call used to delete (or "delete") escrowed BitLocker recovery keys in batches of 16.[7]

It also appears you might only be able to encrypt 10000 disks per day or change your mind on your disk's BitLocker recovery keys 10000 times per day.[8] That might sound like a lot for particularly an individual, but the API also perhaps applies a limit of 150 disks being encrypted every 15 minutes for an entire organisation/tenancy. It doesn't look like anyone has written up an investigation into the limits that might apply for personal Microsoft accounts, or if limits differ if the MS-Organization-Access certificate is presented, or what happens to a Windows installation if a limit is encountered (does it skip BitLocker and continue the installation with it disabled?).

[1] https://learn.microsoft.com/en-us/purview/office-365-bitlock...

[2] https://itm4n.github.io/tpm-based-bitlocker/

[3] https://learn.microsoft.com/en-us/windows/win32/secprov/getk...

[4] https://learn.microsoft.com/en-us/powershell/module/bitlocke...

[5] https://learn.microsoft.com/en-us/graph/api/bitlockerrecover...

[6] https://learn.microsoft.com/en-us/powershell/module/bitlocke...

[7] https://patchmypc.com/blog/bitlocker-recovery-key-cleanup/

[8] https://learn.microsoft.com/en-us/graph/throttling-limits#in...

Re: Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

#606

Earlier quoted context omitted.

> Any power users who prefer their own key management should follow the steps to enable Bitlocker without uploading keys to a connected Microsoft account. Except the steps to to that are disable bitlocker, create a local user account (assuming you initially signed in with a Microsoft account because Ms now forces it on you for home editions of windows), delete your existing keys from OneDrive, then re-encrypt using y…

> delete your existing keys from OneDrive This seems to go against principles of key management. If your key escrow peer has defected, the correct response is to rotate your keys.

Exactly. I question why the parent says you have to re-encrypt the drive.

Microsoft has the KEK or passphrase that can be used to derive the KEK. The KEK protects the DEK which is used to encrypt the data. Rotating the KEK (or KEKs if multiple slots are used) will overwrite the encrypted DEK, rendering the old KEK useless.

Or does BitLocker work differently than typical data at rest encryption?

Re: Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

#607

Earlier quoted context omitted.

Power users should stop bothering with Windows nonsense and install Linux instead so that they can actually have control over their system. It's 2026. The abuses of corporations are well documented. Anyone who still chooses Windows of their own volition is quite literally asking for it and they deserve everything that happens to them.

I’ll bite. What Linux distro currently has the nicest desktop experience? I work on a MacBook but my desktop is a windows PC that I use for gaming and personal projects. I hear Proton has made the former pretty good now, and the latter is mostly in WSL for me anyway. Maybe a good time to try. What do you suggest? I’ll try it in a VM or live usb.

Bazzite. It's KDE, it's easy, it's immutable so you can update and it's unlikely to break shit. It comes with Steam already. Keyboard shortcuts very similar to Windows. Dolphin (File Explorer equivalent) responds as quickly as one would expect File Explorer to respond if it were developed by sane people. You also get an Android-style permission system with Flatseal, so you can disable permissions for various applications.

One warning: keep in mind that if your desktop PC motherboard has a mediatek wifi+bluetooth chip, that chip will probably not work on any version Linux (AFAIK). I don't use wifi on my desktop but I do use bluetooth game controllers. You can replace the chip (which is what I did, with https://www.amazon.com/dp/B08MJLPZPL), get a bluetooth dongle (my friend recommends https://www.amazon.com/Bluetooth-Wireless-External-Receiver-...), or get a PCIe one.

Re: Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

#608
post #407

My Linux drives are all encrypted, and one of the wonderful features of this is that there is no entity or force on this planet that can decrypt them. What happens if I forget my keys? Same thing that happens if my computer gets struck by a meteor. New drive, new key, restore contents from backups. It's simple, secure, set-and-forget, and absolutely nobody but me and your favored deity have any idea what's on my driv…

> What happens if I forget my keys? … restore contents from backups. What happens if you forget your backup keys?

Sticky note in a secure location

Re: Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

#609

Earlier quoted context omitted.

> Any power users who prefer their own key management should follow the steps to enable Bitlocker without uploading keys to a connected Microsoft account. Except the steps to to that are disable bitlocker, create a local user account (assuming you initially signed in with a Microsoft account because Ms now forces it on you for home editions of windows), delete your existing keys from OneDrive, then re-encrypt using y…

> make sure not to sign into your Microsoft account or link it to Windows again That's not so easy. Microsoft tries really hard to get you to use a Microsoft account. For example, logging into MS Teams will automatically link your local account with the Microsoft account, thus starting the automatic upload of all kinds of stuff unrelated to MS Teams. In the past I also had Edge importing Firefox data (including store…

doing things like that which is completely unrelated should be considered data theft, and microsoft should be punished so severely they wish they never had the idea to begin with

Re: Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops

#610
post #290

It's interesting how many comments these days are like, "well of course". Back in the day hackernews had some fire and resistance. Too many tech workers decided to rollover for the government and that's why we are in this mess now. This isn't an argument about law, it's about designing secure systems. And lazy engineers build lazy key escrow the government can exploit.

This is such a lazy take and ignores that this is the only system that has the property of not losing data when users forget their passwords and lose (or likely never write down) their recovery key. That's it. That's the whole thing. Whatever "secure system" you build will not have this property and users will lose their data, be mad at you, and eventually you'll have to turn it off by default leaving everyone's data…

Yep... I've seen exactly this happen. People losing data/access by their own fault and yet being extremely mad at the OS developer or the company they have an account with. And, no, it does not matter if you tell them 100 times that they are responsible for not losing their own keys/passwords, they will still be furious that you set up your system in (from their perspective) such a shitty way that it's even possible for a permanent lockout to happen.
Post reply on HN