3 ms·

The BitLocker recovery key for the user’s device is automatically backed up online in the Microsoft OneDrive account. Even if we trust MS, do we trust MS to

The BitLocker recovery key for the user’s device is automatically backed up online in the Microsoft OneDrive account. Even if we trust MS, do we trust MS to keep these keys safe from outside hackers?

cwyers 11y ago
I mean, the short answer is "no." But the longer answer is more complicated than that. Start off with the question of, is the consequences of not being able to access your device worse than the consequence of someone else getting unauthorized access to your device (or is it worse, controlling for the probability of each?) And then, is Microsoft's storage of those keys more or less secure than any alternative way you could back up those keys remotely? It's possible to both not trust Microsoft to store the keys safely and to make a rational decision to entrust the keys to Microsoft anyway.
dogma1138 11y ago
No this is why it's not the default setting it asks you if you want to do it. That said OneDrive content is encrypted, while the encryption is not perfect it's not going to be "hacked" as easily as one thinks, it's not stored in some global key repository just in your normal onedrive account which is by far more likely to be compromised due to your activity than Microsoft's. BitLocker can fail, simple things like a UEFI/BIOS updates will cause it to fail, playing around with your boot loader or even boot order will cause it to fail, anything that will trigger the TPM will cause it to fail, sudden powerloss/crash can cause it to fail. BitLocker is quite more reliable now but when I was using it with Widnows 7 about 4-5 years ago I had to use the recovery every 2-3 months usually so I had the key printout stored in my wallet this is probably quite less safe than storing the key in OneDrive. Most people use encryption not to fight state level surveillance but to ensure that if they lose their devices or they get stolen they don't need to worry about all their accounts being compromised and their life being penetrated to a point where they need to worry about identity theft, fraud, and extortion. However FDE also puts you at risk for not being able to access the device when you need to, at like usual it will fail at the worst possible moment, the chance of losing all access to your device and data is a big hurdle which prevents people from using FDE and OneDrive-BitLocker integration kinda solves this quite well while still providing tamper resistance/detection.

cwyers 11y ago

I mean, the short answer is "no." But the longer answer is more complicated than that. Start off with the question of, is the consequences of not being able to access your device worse than the consequence of someone else getting unauthorized access to your device (or is it worse, controlling for the probability of each?) And then, is Microsoft's storage of those keys more or less secure than any alternative way you could back up those keys remotely? It's possible to both not trust Microsoft to store the keys safely and to make a rational decision to entrust the keys to Microsoft anyway.

dogma1138 11y ago

No this is why it's not the default setting it asks you if you want to do it. That said OneDrive content is encrypted, while the encryption is not perfect it's not going to be "hacked" as easily as one thinks, it's not stored in some global key repository just in your normal onedrive account which is by far more likely to be compromised due to your activity than Microsoft's. BitLocker can fail, simple things like a UEFI/BIOS updates will cause it to fail, playing around with your boot loader or even boot order will cause it to fail, anything that will trigger the TPM will cause it to fail, sudden powerloss/crash can cause it to fail. BitLocker is quite more reliable now but when I was using it with Widnows 7 about 4-5 years ago I had to use the recovery every 2-3 months usually so I had the key printout stored in my wallet this is probably quite less safe than storing the key in OneDrive. Most people use encryption not to fight state level surveillance but to ensure that if they lose their devices or they get stolen they don't need to worry about all their accounts being compromised and their life being penetrated to a point where they need to worry about identity theft, fraud, and extortion. However FDE also puts you at risk for not being able to access the device when you need to, at like usual it will fail at the worst possible moment, the chance of losing all access to your device and data is a big hurdle which prevents people from using FDE and OneDrive-BitLocker integration kinda solves this quite well while still providing tamper resistance/detection.