Pretty sure the same applies to all the passwords/passkeys/2FA codes stored in the Authenticator app with cloud backup on.
Use 1Password or similar instead. They’re keyed against a key they don’t have access to.
Microsoft will give the FBI a Windows PC data encryption key if ordered
91–100 of 346 posts
Re: Microsoft will give the FBI a Windows PC data encryption key if ordered
#92Earlier quoted context omitted.
https://linuxmint.com/ https://ubuntu.com/download/desktop https://archlinux.org/ https://www.kali.org/get-kali/#kali-platforms https://fedoraproject.org/ Every bad day for microsoft is yet another glorious day for linux.
And MacOS, which I suspect may be the more obvious choice for many users.
MacOS has basically the exactly same problem, ADP isn't enabled by default and your data gets backed up to iCloud unencrypted.
Re: Microsoft will give the FBI a Windows PC data encryption key if ordered
#93Earlier quoted context omitted.
Disagree. If the path is shrouded behind key presses and commands which are unpublished by MS (and in some instances routes that have been closed), it may as well be.
> it may as well be. That defies the definition of "forced". Forced means no option. You can disagree all you want -- but at a technical level, you're incorrect.
Try doing this as a normies without technical guidance. Technically correct, this time, is not the benchmark.
Re: Microsoft will give the FBI a Windows PC data encryption key if ordered
#94Beyond the crypto architecture debate, I don't really understand how could anyone imagine a world where MS could just refuse such a request. How exactly would we draft laws to this effect, "the authorities can subpoena for any piece of evidence, except when complying to such a request might break the contractual obligations of a third party towards the suspect"? Do we really, really, fully understand the implications…
I don't think that many people here are naive enough to believe that any business would fight the government for the sake of its customers. I think most of us are simply appalled by this blatantly malicious behavior. I'm not buying all these "but what if the user is an illiterate, senile 90-year-old with ADHD, huh?" attempts to rationalize it away. it's the equivalent of the guy who installed your door keeping a copy…
Assume good intent. If Microsoft didn't escrow the keys, the next HN post would be "mIcR0SofT Ate mY chILDhooD pHOTos!!"
Re: Microsoft will give the FBI a Windows PC data encryption key if ordered
#95Beyond the crypto architecture debate, I don't really understand how could anyone imagine a world where MS could just refuse such a request. How exactly would we draft laws to this effect, "the authorities can subpoena for any piece of evidence, except when complying to such a request might break the contractual obligations of a third party towards the suspect"? Do we really, really, fully understand the implications…
Encrypt the BL key with the user's password? I mean there are a lot of technical solutions besides "we're gonna keep the BL keys in the clear and readily available for anyone".
For something as widely adopted as Windows, the only sensible alternative is to not encrypt the disk by default.
The default behavior will never ever be to "encrypt the disk by a key and encrypt the key with the user's password." It just doesn't work in real life. You'll have thousands of users who lost access to their disks every week.
Re: Microsoft will give the FBI a Windows PC data encryption key if ordered
#96Due to Third Party Doctrine, Microsoft doesn't even NEED a "legal order." It's merely a courtesy which they could change at any time. Based on the sheer number of third parties we're required to use for our day to day lives, that is ridiculous and Third Party Doctrine should be eliminated. Ref: https://en.wikipedia.org/wiki/Third-party_doctrine
>people who voluntarily give information to third parties
Is it the case with BitLocker? The voluntary part.
Re: Microsoft will give the FBI a Windows PC data encryption key if ordered
#97Any reason to believe Apple won't do the same with whatever we backup in iCloud?
Except you’re not coerced (near enough forced?) to use an account password managed by MS on Apple. Until MS themselves publish, for home users, how to set up without an MS account, I’m considering it forced.
Re: Microsoft will give the FBI a Windows PC data encryption key if ordered
#98Earlier quoted context omitted.
https://linuxmint.com/ https://ubuntu.com/download/desktop https://archlinux.org/ https://www.kali.org/get-kali/#kali-platforms https://fedoraproject.org/ Every bad day for microsoft is yet another glorious day for linux.
> Every bad day for microsoft is yet another glorious day for linux. Nah. If that were the case, Linux would dominate personal computer statistics. The reality is that most mainstream users just don't care. But, of course, that won't stop us.
I would also argue that _what_ personal computing means to most people has also evolved, even with younger generations. My gen Z nephew the other day was faberglasted when he learned I use my Documents, Videos, Desktop folders, ect. He literally asked "What is the Documents folder even for?". To most people, stuff is just magically somewhere (the cloud) and when they get a new machine tbey just expect it all to be there and work. I feel like these cryptography and legality discussions here on HackerNews always miss the mark because we overestimate hiw much most people care. Speaking of younger generations, I also get the feeling that there isn't such a thing as "digital sovereignty" or "ownership", at least not by the same definitions we gen x and older millennials internalize those definitions.
Across the generations, there are always a few groups to where cryptographic ownership really matter, such as journalists, protesters, and so on. Here on HN I feel like we tend to over-geeneralize these use cases to everybody, and then we are surprised when most people don't actually care.
Re: Microsoft will give the FBI a Windows PC data encryption key if ordered
#99Headline says “…if asked” Article and facts are “…if served with a valid legal order compelling it” ∴ Headline is clickbait.
You are arguing semantics, whereas the point is that A) they have your keys, and B) they will give them away if they will have to
It’s really just A. Point B is pretty much just derived from there.
Re: Microsoft will give the FBI a Windows PC data encryption key if ordered
#100Earlier quoted context omitted.
Only if that authenticator/password manager app is not end-to-end encrypted.
No, not "only". E2EE is now used as a dog whistle. Who holds/controls the keys on both ends?
End-to-end usually means only the data's owner (aka the customer) holds the keys needed. The term most used across password managers and similar tools is "zero knowledge encryption", where only you know the password to a vault, needed to decrypt it.
There's a "data encryption key", encrypted with a hash derived of your username+master password, and that data encryption key is used locally to decrypt the items of your vault. Even if everything is stored remotely, unless the provider got your raw master password (usually, a hash of that is used as the "password" for authentication), your information is totally safe.
A whole other topic is communications, but we're talking decryption keys here