This is not directly on Microsoft as you have to be either ignorant or special kind of stupid to upload your encryption keys to US cloud. The government can request access to any data and a company can’t do anything.
The only way to resist this is to not store anything unencrypted from your customers which is quite doable but clearly microsoft has no interest in this.
If they’re selling bitlocker as “full-disk encryption”, doesn’t that open them up to a class action since encryption with a backdoor isn’t encryption?
Nah, it’s encryption all right, they just back up the key in case you lose it. Which is a feature. https://aka.ms/bitlockerrecovery
I hear iMessage e2e-encrypted messages are also backed up into cloud as plaintext…
Grey area, user chose to store the private bitlocker key to their online Microsoft acct, it’s optional. It’s still a dirtbag move, but probably less illegal.
No they’re not really technically “selling” it. Its bundled with Windows.
Its the home edition thing where they require a microsoft account. Afaik, for the Pro version of Windows, Bitlocker doesn’t require a microsoft account.
They’re selling Windows and one of the selling points is that it includes full disk encryption. Thus they are selling full disk encryption.
Most people have windows because of OEM keys, so you don’t really have a direct bussiness relationship with Microsoft so its kinda harder to sue.
If you build a pc then separately bought a key, then you might have a better case.
(Disclaimer: I am not a laywer)
What if you downloaded an iso from Microsoft and typed a simple command into powershell to activate it? 🏴☠️
But yeah all I’m saying is Microsoft are definitely on shaky ground with their sales claim here. However it’s no less shaky than things they were already convicted of years ago yet seem to be doing yet again, eg bundling Internet Explorer/Edge as the default browser - which has now expanded into occassionally resetting your default apps to Microsoft ones with system updates.
What if you downloaded an iso from Microsoft and typed a simple command into powershell to activate it? 🏴☠️
I mean you’re gonna have to prove in court how you’ve been “harmed” and if you don’t have a sales receipt from microsoft, then I don’t see how a court is gonna side with you.
Pretty sure some lawyer that works for Microsoft is gonna try to counterclaim and say you committed copyright infringement by bypassing the normal activation method.
And can you even afford lawyers lol? Most of us cannot afford constantly paying for laywers that cost $200/hour on the cheaper end, and suing a massive corporation is an uphill battle.
Lol setting aside the joke, and of course if you don’t pay you won’t have a case, but if you had paid I think there would be some statutory rights that would make a claim straightforward and wouldn’t require a lawyer. Small claims is a pretty universal concept regardless of jurisdiction, the limit varies but everywhere has some similar avenue. Filing fees are small and lawyers are not usually involved, just two parties and a judge, and these days it can be done remotely.
Mandatory Arbitration in ToS have entered the chat
You have like 30 days, from the date of sale, to opt out in most of these clauses, if you didnt mail a fucking letter to them to opt out, then you’re fucked.
lol. Last time I checked the rule of law in the US only matters if corporations want it to
Oh you can sue if you have Epic Games level of money and access to lawyers. Otherwise corporate says “fuck you”.
2026 linux
Exposing? Microsoft has made it very clear for a while that your Bitlocker keys are synced to your Microsoft account.
Hell, they even have a support page for it. Most of their support pages are nearly useless, but this one is even readable by a normal person.
And before someone mentions the part about Microsoft Support not having access to keys (because some smart ass always does for this stuff)… Just think for a second. Of course customer support doesn’t have access to the keys. What Support can do is not a limit for legal disclosure. A legal warrant (like used here) means they’ll give any info they have in a heartbeat.
Why can’t just one of our companies not be blood-sucking assholes?
It wasn’t gonna be M$ my guy
Because if a company gives up profits to be nice, another company will swoop in and get inherently rewarded by doing the profitable thing instead
*laughs in rich*
It’s all being dumped into data centers now. Google and Meta don’t need your face to prove who you are to create a new login, they need it to link data. What’s awful is the need to log in is so intense, it worked. Apparently YouTube aspirations are worth it. And shopping Facebook marketplace.
Now, Amazon isn’t allowing returns for many an individual without a pic or upload of government issued ID. Amazon allowed you to both pay and have an item shipped without this ID. But for a return, they now need it. I’m not saying this ask isn’t multipurpose, but it also links your data together and is probably being dumped into data centers with everything else.
My point is, it’s not just Microsoft’s choices.
Why would a company not be, not like people are going to stop using Windows
If only there were another operating system that people could use rather than have their privacy and security raked over the coals by poor design fueled by next quarter’s profits.
It’s a shame that, according to a recent study of social media respondents, 98% of the Internet are Professional Valorant streamers, who play League of Legends and side hustle as a Mechanical Engineer and Digital Artist or they could browse around the world of alternative operating system and mayhaps find some other Operating System which fits their needs (TempleOS).
Lol yeah we have literal death squads using data from data brokers to identify where to raid, yet asking one to not use Google Chrome is simply too much.
Yeah, but giving up my Apex Legends career and most significant life investment is a lot harder than tolerating a little fascism, what with me being a white person and all.
(/s because there are Apex Legends players scrolling by between rounds)
go ask adam smith.
I mean, it was never going to be Microsoft
It’s not a security flaw, it’s by design. Microsoft has been building this surveillance apparatus for years, and the purchase of government access to your computer and data using your tax dollars is a lucrative alignment of state and corporate power. Their recent design choices point to a rabid desperation to turn your PC into an Apple-style walled-garden.
It goes like this:
-
Require online Microsoft account creation.
-
Require TPM compliance to run Windows.
-
Forcibly encrypt the user’s data under the guise of “security”, even without permission or even user action. (Encryption is good! Right?)
-
Link your identity, payment information, data, online activity, and encryption keys to your hardware ID.
-
Record everything you do and use that data to train an AI model with onboard tensor hardware.
-
Exfiltrate the entire model, or just query it remotely for “online services.” Or, in this case, just have MS give you the fucking recovery keys. lol
All done “securely” with tamper resistance and mathematical verifiability that whatever is on your device is yours, and that you took that action with limited plausible deniability.
If you think you’ve got nothing to hide, think again about the current activities of ICE, law enforcement investigations based on reproductive health data, the pornography suppression movement, age verification, and the data harvesting of dissenting speech. What’s legal today can quickly become “illegal” tomorrow. The constitution is just a piece of paper in a fancy climate controlled box.
Project PRISM has matured.
Linux, people. Linux.
Suggest Pop!_OS for the fearful.
Suggest Pop!_OS for the fearful.
Mint, I think you mean Mint.
I realize Linux distros inspire arguments on the level of which rule set is the best rule set for D&D. As such, everyone is right, and no one can really prove anyone else wrong no matter how long they choose to argue. Unless we’re discussing the awfulness of 4.0 of course.
Indeed. I think the inevitable discussion about best distro, which always comes up in this context, is more hurtful than constructive, since it may end up confusing and scaring away potential Windows-defectors.
The point is to get them to try out linux and get a taste for it, and only when they have become comfortable with the concept and realised it is not so scary of a change that some people claim, should they begin to consider which distro is right for them.
I haven’t seen anyone argue on the ruleset of DnD, so I’m disregarding that, but I agree with your point. Remember: Switcning distros is easy.
Yes, I am indeed Linux people.
sorry, what is Linux? I’ve never heard of it
It’s a German laundry detergent brand.
Don’t most Linux distributions not enable full disk encryption by default? How would that have improved the situation in this case?
It’s worse than that, lots of these linuxes actually have this builtin virus called wine, which means they are really just windows in disguise.
It also makes them look like a hacker to the FBI, that’s why TYOTLD has never come. Most linusers are getting dissapeared to guano bay.
Far safer to stay on windows, linus is only suitable for real hackers who can grep their way into cia mainframe to expunge their records.
While it’s rarely by default (I actually don’t know any that do by default but), it is usually a simple checkbox during the installation. And a provided password, of course.
Arch for the chads (and authors of future ‘Help my Linux Broke’ OPs)
Wait. You’re saying there’s a distro easier out of the box than Pop! ??
You make Microsoft act like some mastermind genius carefully planning to take away everyone’s rights instead of a bunch of clueless DIrectors who are chasing KPI’s. Just happens more people relying on their technology means when the Government comes knocking they can give them all the data they want.
If they were that interested, why would they push encryption at all?
That’s a great question, and it is because it enables a chain of cryptographic controls that enable verification, tamper resistance, and secrecy while selling Bitlocker as computer security. It is technically secure, except that MS has your recovery keys and can just give them to whoever they want, like the FBI!
This way, they can mathematically verify:
-
Who you are and the exact unique machine you use (verification from a unique machine ID associated with your encryption keys and Windows account data)
-
Know that the data has not been altered in transit (tamper resistant hashing of your data)
-
No one else knows except them (secret encryption keys stored in hardware that only Microsoft controls, not you, Microsoft)
This architecture also keeps their data on your machine secure. If someone maintains an encrypted archive on your hard drive that only they control the keys to, say like a movie or a video game, who owns that data really? If it’s decrypted only for authorized use, you’re really only renting that content from the owner. This is called Digital Rights Management, and it’s much easier when this security chain is in place.
Technically they could do this remotely if they really wanted to and your machine were powered. Imagine what you could do with this power for every Windows machine on the planet.
-
Verification of identity.
Marketing. Just that.
Yeah but as long as you download CSAM you’re on this governments “nice” list. Use that to throw them off your scent.
Oh they like cheese pizza? Must be a god-fearing republican like us. Move along.
-
Oh no, who could have possibly seen this coming when Microsoft decided to back up your full-disk encryption key automatically to OneDrive.
Smart of them to deploy automatic full disk encryption just as open source projects like Trucrypt and Veracrypt were starting to become mainstream, capturing their market share (Netscape Navigator-style). Very incompetent of them to include many glaring backdoors that completely defeats the encryption that they offer.
In addition to being vulnerable to law enforcement through subpoenas on the stored key. Anytime you run a Windows update and the system has to reboot, it writes a ‘clear key’ to the hard drive which can be easily retrieved if the disk is stolen and also they bypass TPM Validation.
You know, the thing that is so important to have that you were forced to buy an entirely new computer… it is not active during a system update and anybody who had access to your hard drive can write arbitrary code into your system files.
Well, you would think that this isn’t very useful, after all they would have to have pretty good timing to catch you updating your computer to remove the hard drive, right?
Nope, if they steal your whole computer and plug it into power and a network connection, the next time a Windows update hits the system will automatically apply the update (absent a very specific Group Policy) and write the full-disk encryption key to the hard drive before shutting down.
I’m no expert computerologist, but I think that any system that requires anybody but you to have your key is insecure. If this is the kind of poor design choices that they make in regards to disk encryption then I would personally have no confidence that their proprietary code is not equally porous.
’m no expert computerologist, but I think that any system that requires anybody but you to have your key is insecure.
Computerologist here. You are 100% correct. If anyone says otherwise, they are selling you something.
This is configurable; you can set BitLocker to always require a password on boot. If you do that, the clearkey doesn’t get placed (yet). If you set this mode, the key also doesn’t get uploaded to OneDrive. Of course, there’s a big warning when you set it up, and it recommends you print off and save the one time recovery key list.
Easier just to use an OS that doesn’t require you to jump through hoops to secure it though.
You can also disable it with a Group Policy too and delete any keys that were uploaded to Microsoft with manage-bde while adding your own keys, but for the average person Bitlocker is going to be how it comes by default.
Pre-builts are even worse because that’s another party who has had access to your keys and there are not laws that they would violate by keeping copies (for your convenience, of course)
TrueCrypt, my beloved. Such an amazing set of features and super easy to use. I so wish there was a modern open-source equivalent with the same intuitive approach. I especially liked the ability to do fancy stuff like disguising data with a false password or using any file as the key.
How about a modern fork of Truecrypt that looks and works exactly like it?
Have you looked at Veracrypt?
Well shoot. It’s my lucky day. And cross platform even! Thanks!
On Linux, selecting LUKS when you install encrypts the disk without the potential for this problem. So far it’s proven to be very reliable at stopping state level actors, just don’t use a password that you use elsewhere
You can also, with a bit of fiddling use hardware security keys like Yubikey: https://gist.github.com/cmedianu/470a49038e919cf5bc98cd0d2299c484 if you don’t want to remember passwords (You can also install a password in another LUKS slot and it will fall-back to the password if your key fails)
I’m not surprised. The standard Microsoft disclosure on my work laptop at the login screen states any use ofbthw computer may be monitored and/ or recovered by Microsoft and law enforcement. That’s why Microsoft products are not present in my home.
“Flaw”
If you really were still naive enough to think that a public tech company cares about your right to privacy at that point, it’s pretty much on you.
Well, if thats not enough of a reason to move off of Microsoft products, then i don’t know what is.
Didn’t this happen with an iPhone a few years back? FBI couldn’t get into a suspect’s phone, Apple stood firm publicly, but then somehow the FBI got in anyway? Maybe I’m misremembering.
That was the opposite. The FBI got in, but without Apples help.
Also iCloud has a distinct option to not give Apple your recovery keys. I believe the had to disable it in the UK to comply with regulations.
Apparantly that suspect had a 4 digit pin so once they bypassed the Secure Enclave, they can brute force it in 10 seconds
For Phones, 20 character alphanumeric password is a hassle, but for computers, you can easily use a 10 word passphrase.
If you use a long password, bypassing the password entry limit doesn’t matter if the algorithm itself is secure.
In this case, the key was uploaded to a microsoft account… so you don’t even need a back door, just walk right in…
but for computers, you can easily use a 10 word passphrase.
Correct Horse Battery Staple
Thanks, Mine is: Incorrect Cow AC-Power Paperclip
/j
Mine is ***********************
Weird, when you type your root password it posts as stars.
hunter2
Why is it always password123?
