641–650 of 694 posts
Earlier quoted context omitted.
Buy a laptop with less problems on Linux if that's your intention.
What laptops would you recommend? I didn’t realise framework laptops struggled with Linux?
Earlier quoted context omitted.
> If it weren't for Bitlocker, their laptops wouldn't be encrypted at all! And because of Bitlocker, their encryption is worth nothing in the end. > if these people were using Linux, their laptops wouldn't be encrypted Maybe, maybe not. Ubuntu and Fedora both have FDE options in the installer. That's objectively more honest and secure than forcing a flawed default in my opinion.
> And because of Bitlocker, their encryption is worth nothing in the end. No, it's worth exactly what it's meant for: in case your laptop gets stolen! > flawed default Look, in terms of flaws I would argue 'the government can for legal reasons request the key to decrypt my laptop' is pretty low down there. Again, we're dealing with the general populace here; if it's a choice between them getting locked out of their c…
If my laptop gets stolen and it's worth something, the thief will wait until they can crack the management keys. We see this with corporate-locked laptops and Macbooks, iPhones and Androids, and other encrypted curiosities that get cracked at a lab in Tel Aviv for pennies on the dollar.
> Those who actually care about privacy will setup FDE themselves
This line is equivalent to forfeiting your position so I don't even know what to argue over anymore. I do care about privacy and I have no idea who you're arguing in-favor of.
Earlier quoted context omitted.
If you’re doing your work inside the windows machine, what protection does Linux as a host get you?
The topic is bitlocker, and Microsoft, and keys. With a VM running on an encrypted file system, whatever a warrant for a bitlocker key might normally provide will be hidden behind an additional layer that Microsoft does not hold the keys to. (Determining whether that is useful or not is an exercise for the person who believes that they have something to hide.)
Earlier quoted context omitted.
> make sure not to sign into your Microsoft account or link it to Windows again That's not so easy. Microsoft tries really hard to get you to use a Microsoft account. For example, logging into MS Teams will automatically link your local account with the Microsoft account, thus starting the automatic upload of all kinds of stuff unrelated to MS Teams. In the past I also had Edge importing Firefox data (including store…
Teams inside a VM it is, then.
Earlier quoted context omitted.
teams works fine in website form for me because it IS a website (that uses an extra ~1gb of ram running as a desktop app because its also a separate browser)
Reportedly, that’s how they’re making the Start Menu now, too.
The Start Menu is fully native. The "Recommended" section (and only it) is powered by a React Native backend, but the frame & controls are native XAML. (I.e. there's a JS runtime but no renderer)
Earlier quoted context omitted.
Why would you need to create a local account? You can just not choose to store the keys in your Microsoft account during BitLocker setup: https://www.diskpart.com/screenshot/en/others/windows-11/win... Admittedly, the risks of choosing this option are not clearly laid out, but the way you are framing it also isn't accurate
All "Global Reader" accounts have "microsoft.directory/bitlockerKeys/key/read" permission. Whether you opt in, or not, if you connect your account to Microsoft, then they do have the ability fetch the bitlocker key, if the account is not local only. [0] Global Reader is builtin to everything +365. [0] https://github.com/MicrosoftDocs/entra-docs/commit/2364d8da9...
Earlier quoted context omitted.
It's largely the same for all automatic updating systems that don't protect against personalized updates. I don't know the status of the updating systems of the various distributions; if some use server-delivered scripts run as root, that's potentially a further powerful attack avenue. But I was assuming that the update process itself is safe; the problem is that you usually don't have guarantees that the updates you…
> the problem is that you usually don't have guarantees that the updates you get are genuine A point of order: you do have that guarantee for most Linux distro packages. All 70,000 of them in Debian's case. And all Linux distro distribute their packages anonymously, so they can never target just one individual. That's primarily because they aren't trying to make money out of you. Making money requires a billing relat…
You assume the binary can't just have a machine check in itself that activates only on the target's computer.
Earlier quoted context omitted.
> Any power users who prefer their own key management should follow the steps to enable Bitlocker without uploading keys to a connected Microsoft account. Except the steps to to that are disable bitlocker, create a local user account (assuming you initially signed in with a Microsoft account because Ms now forces it on you for home editions of windows), delete your existing keys from OneDrive, then re-encrypt using y…
Note that password-based Bitlocker requires Windows Pro which is quite a bit more expensive. > sign into your Microsoft account or link it to Windows again. For reference, I did accidentally login into my Microsoft account once on my local account (registered in the online accounts panel). While Edge automatically enabled synchronization without any form of consent from my part, it does not look like that my Bitlocke…
https://support.microsoft.com/en-us/windows/device-encryptio...
> For reference, I did accidentally login into my Microsoft account once on my local account (registered in the online accounts panel)
Those don't usually count as the "primary" MS account and don't convert a local account. For example, you can have a multiple of those, and generally they're useful to save repeated signins or installing stuff from the Microsoft Store that require a personal account.
Earlier quoted context omitted.
You can turn it off without resorting to a local account, although it's non-obvious. GPEdit -> Computer Configuration → Administrative Templates → Windows Components → BitLocker Drive Encryption → Operating System Drives → “Choose how BitLocker-protected operating system drives can be recovered” Repeat for other drives.
I imagine you have to re-encrypt the drive after that, though, for it to have some real effect