7 ms·

Recently Bought a Windows Computer? Microsoft Probably Has Your Encryption Key

165 points by kmfrk 11y ago

panarky 11y ago
I'm more confused now than ever. Is it true that all Windows 10 SKUs have full-disk encryption turned on by default? And this automatic full-disk encryption is called "device encryption", which is really the same as BitLocker but without any way for the user to control it? And you can't get BitLocker on the Home edition? If you immediately set up BitLocker, it allows you to save or print your key instead of sending it to Microsoft. But does it use the same key as the default "device encryption" that was already sent to Microsoft? BitLocker doesn't create a new key and re-encrypt the drive? And the TPM automatically loads your key into RAM when the device is powered on, so it's still vulnerable when the device is not in your possession? Are you safe if you (1) create a local account instead of a Microsoft account, (2) use BitLocker instead of device encryption, (3) save your key locally instead of sending it to Microsoft, and (4) require a separate PIN or key to boot the computer in addition to the local Windows account?? It would be helpful to describe exactly how to create a local account, because the Windows 10 setup procedure hides this pretty well. It looks like the only option is to use an existing Microsoft account or create a new one during setup. And it would be great to explain how to create a secondary PIN or key since that doesn't show up in the BitLocker UI until you edit the local policy[1]. [1] https://weikingteh.wordpress.com/2011/04/18/how-to-enable-bitlocker-to-prompt-for-pin-during-startup/ https://weikingteh.wordpress.com/2011/04/18/how-to-enable-bi...
- ashmud 11y ago
  From only reading the article, it looks like they're shipping BitLocker already on, and that the recovery key Microsoft has is the BitLocker recovery key for the already enabled BitLocker configuration. Turning BitLocker off and back on resets this key. As long as you don't send it to Microsoft after re-enabling, Microsoft won't have it.
  - mhurron 11y ago
    > As long as you don't send it to Microsoft after re-enabling, Microsoft won't have it. Unless you have a Home edition of windows, in which case you have no control over it at all. In order to use device encryption you have to sign on with a Microsoft Account and Microsoft will have the key.
    - cmurf 11y ago
      I'm pretty sure that key can be deleted/removed from the online account; of course it's already out of your control, so you're now in a position of trusting the completion of Microsoft's key deletion.
  - orillian 11y ago
    Just an aside: I'm running Windows 10 Pro and Bitlocker is off for all 4 of the drives in my machine. This machine was setup from a fresh install of windows 10 shortly after it went live in July. Only a single data point, but apparently there are cases when Microsoft does NOT encrypt the drives.
    - scholia 11y ago
      Disk encryption is enabled on some shipping machines, which is to say, it has been enabled on the three brand new Windows 10 machines I've used. The OEM is responsible for the installation, so I'd assume this is an OEM choice, but obviously I don't know. I didn't notice at first, and really, there's no reason why I should have noticed. Also, I assumed Windows 10 Home didn't come with BitLocker anyway. The Windows 10 security overview on Microsoft TechNet includes the following statements: "Modern Windows devices are increasingly protected with device encryption out of the box and support SSO to seamlessly protect the BitLocker encryption keys from cold boot attacks." "BitLocker supports encrypted hard drives with onboard encryption hardware built in, which allows administrators to use the familiar BitLocker administrative tools to manage them." https://technet.microsoft.com/en-us/library/mt601297%28v=vs.85%29.aspx https://technet.microsoft.com/en-us/library/mt601297%28v=vs....
- cmurf 11y ago
  Unlikely that the KEK on the TPM is moved into RAM. The TPM would internally decrypt the KEK encrypted DEK, and then use the DEK in RAM (more likely it's just in the CPU using AES-NI, finding it in RAM would be non-trivial assuming the implementation is good). This is compared to e.g. either Linux (LUKS) or OS X where the encrypted DEK is stored on the drive itself (outside of the encrypted volume of course), since neither of them leverage a TPM at the moment.
morganvachon 11y ago
One can replace "Windows computer" with "Android device" and "Microsoft" with "Google" and the article is still factually correct. In other words, how is this any different from Google doing the exact same thing when you sign in to an Android device? On another note, the article gives clear instructions on how to generate a new key without giving it to Microsoft, something that (to the best of my knowledge) is impossible to do on Android or Chrome OS. I get it, it's easy to pick on Microsoft and for good reason. But the hyper focus of this article screams bias.
- serge2k 11y ago
  > how is this any different from Google doing the exact same thing when you sign in to an Android device It's microsoft, so it's big evil being evil for the sake of being evil and you should hate them for being evil.
- zeveb 11y ago
  > In other words, how is this any different from Google doing the exact same thing when you sign in to an Android device? When did Google start storing Android full disk encryption passphrases? I certainly haven't heard that it does.
- Flimm 11y ago
  How do you know that the key for full disk encryption on Android is sent to Google?
  - morganvachon 11y ago
    The very fact that we have to ask is what bothers me. Microsoft plainly states that they store the key for full disk encryption, and offer the ability to generate a new key not stored by them (as covered in the article). They also offer BitLocker in their Pro and Enterprise OSes, for even finer grained, user controlled, offline encryption management. On the other hand, Google claims they don't store your Android disk encryption key, yet for all their other services, they do. (They also backtracked on encrypting MicroSD cards, leaving your actual valuable data exposed yet giving you a false sense of security, but that's a discussion for another day). Chrome syncing (and by extension Chrome OS), for example, is decrypted by your Google account login. You can set up a second, separate passphrase for those services, but again the key is definitely stored by them. Given that they have done some really shady stuff in the recent past (Chromium builds that download closed-source binaries after compiling from source and executing for the first time, etc.), I don't trust them as much as I trust Microsoft. And that's not a lot of trust in the first place.
tptacek 11y ago
I'm going out on a limb and suggest that Micah Lee understands why Windows works this way: because Windows is the most popular operating system in the world, and the overwhelming majority of Windows users don't understand how encryption works, and are shocked and dismayed to discover that losing their key more or less forfeits all the data on their disk. It's straightforward to set Bitlocker up so that Microsoft doesn't hold a backup key. Microsoft is doing what their userbase wants them to do. I'm not sure what's interesting about this story.
- benevol 11y ago
  There really is no ground for any excuses here. Companies like Microsoft and Google doing their part to further the government's agenda for the most complete surveillance and/or control over user data is simply not acceptable. The only valid answer is to switch to Linux. (And don't ask the average user to understand or do anything to prevent that. Default matter.)
  - Amezarak 11y ago
    The previous status quo was that law enforcement, criminals, or that guy at Best Buy could by default get all the data off your drive without any effort whatsoever. Microsoft added drive encryption by default with easy recovery if you forget your password - which necessitates Microsoft keeping the recovery key by default. Power users can change these settings. There is no "excuse" here, Microsoft has improved the situation. (And unless things have changed recently, user action is required on virtually every popular Linux distribution except Android to get any drive encryption at all.)
    - benevol 11y ago
      Everybody's talking about encryption these days. People are finally waking up and getting a bit suspicious. Obviously it is convenient for Microsoft to produce an inferior solution which also happens to be what the government wants. What people need is education about the situation and a real solution. Not a "solution" that makes them feel secure, which is what Microsoft sells here.
cmurf 11y ago
I agree that this is better than no encryption. And they're likely escrowing (in most but not all cases) the key for valid UX reasons. The tricky part is doing it without asking the user. Apple used to do optional escrowing on OS X with File Vault 2, but they asked the user. The privacy/surveillance concern comes to play now that China has a law (as of Sunday) saying that tech companies need to be able to hand over keys on demand/request (whatever). Since Microsoft escrows them, they'd be capable of complying. Google and Apple who don't escrow them at all anymore, can't actually comply. Uncertain is whether the law requires them to start a key escrow function. EDIT: And then what if/when U.K. wants access on demand to that escrow service? And then what if/when the U.S. does? If the companies have the keys, it doesn't require a law to get access to them, just a subpoena. It'd require a law to compel the companies to create the escrow capability though.
xenophonf 11y ago
I still wouldn't escrow my disk encryption keys, but I'd be happier if Apple and Microsoft could guarantee that they couldn't access the escrowed keys, kind of like how tarsnap's design means that cpersiva doesn't have access to my backups.
- feld 11y ago
  Tarsnap's design means the keys never leave your possession; they're never escrowed. You can do this with Microsoft and Apple products, but it's not default.
nivla 11y ago
Hasn't this been discussed multiple times? Microsoft tends to backup your key because the majority base doesn't understand how encryption works. When an average person thinks of passwords, they think there is a way to reset it. Good luck explaining to your grandma why all her favorite photos disappeared when she forgot the password. I think for an average Joe this seems like a good strategy. With the defaults being off if the computer is stolen, all of their data and identity are stolen with it. This atleast acts like a door for an otherwise open house. Advanced users can use another encryption or do what the article suggests to not sent the key to Microsoft.
jcrawfordor 11y ago
> As Green puts it, “Your computer is now only as secure as that database of keys held by Microsoft, which means it may be vulnerable to hackers, foreign governments, and people who can extort Microsoft employees.” One way to think about this: before Win10, my computer was only as secure as the car I sometimes left it in, not to mention that it was only as secure as a bag which I admit I sometimes left out of my sight in coffee shops for seconds at a time. Overall this is a great win. The NSA is not the only actor that FDE secures us from: FDE is more critically protection from anyone who can smash the window of your car or grab your computer in a public place and run. Security is always full of compromises, and MS here is making a compromise to provide protection from the latter group without significantly damaging data availability. Think about this from a C/I/A perspective - that is, Confidentiality/Integrity/Availability as the security industry often discusses. Will-implemented encryption, with as few parties as possible in control of the key (e.g. only the data owner), is excellent for confidentiality and integrity. However, it can have severe impacts on availability if the key is lost. Controlling availability often requires policy and procedure controls (e.g. manually keeping a backup of the key on media stored in a secure place) which cannot simply be automatically enabled like FDE can. Users who are worried about protection from actors like the NSA must take significantly more stringent security measures, including less technical policy and procedural controls, and Windows gives them the capability to do so by re-encrypting without backup to Microsoft and making their own backup which they can manage as they see fit.
- dublinben 11y ago
  >before Win10, my computer was only as secure as the car I sometimes left it in This was nobody's fault but your own. FDE has been available for Windows for over a decade. You didn't have to wait for Microsoft to (poorly) implement this.
  - jcrawfordor 11y ago
    I've actually had FDE for ages (back to when I was using TrueCrypt!), that point was for illustration from the perspective of a normal user, who would have had almost zero exposure to these options. Totally guilty on leaving my computer in coffee shops, though.
dogma1138 11y ago
The keys are stored in your individual OneDrive not a centralized database. OneDrive key integration isn't on by default even if you link a windows live account to your windows ID. Also it's important to note that Microsoft doesn't have your key it has a key recovery element they still need the TPM and your physical drive to recover the full key this is a very very important part as they 1) still need physical access to your machine and 2) cannot arbitrarily encrypt data on your behalf. FDE isn't there to stop government surveillance it's to stop your life from being ruined because you forgot your laptop at a coffee shop or because the guy who you gave your laptop for repairs is a watcher. FDE's biggest problem is that it can fail very easily and very miserably especially when anti-tampering is enabled with external hardware. This solution solves all the usability issues as long as you can get online your laptop will not turn into a paper weight, I can't count the number of times that BitLocker especially 1.0 failed on me when the anti tampering was triggered due to power failure, BIOS update, boot loader reconfiguration and just because it can. With this you get to keep all the anti tampering while still keeping your key relatively secure, OneDrive is probably more secure than pretty much any location you would normal keep the key recovery element yourself (Mine was both my wallet and a scrambled version under the battery when i still have laptops with removable battery). P.S. This is like the 10000's time this has been posted every time some one else discovers this and goes for the clickbait.
- chinpokomon 11y ago
  This is important. It isn't the same as them possessing the key. They still require physical access and of course with physical access, all bets are off.
- geographomics 11y ago
  The recovery password doesn't require anything stored in the TPM; if you just had an image of the disk and the recovery password, you could decrypt it. I agree with everything else you stated though.
deleted 11y ago
[deleted]
mtnygard 11y ago
I know that this article is specific to Windows 10. However, it sounds like the same caveats and risks also apply to Apple's iCloud keychain. I'm not trying to excuse one by pointing at the other... I genuinely want to understand any differences in the implementations and the security implications of those differences.
anonbanker 11y ago
So yeah, Linux is stable, and secure. I suggest Calculate Linux or Slackware, if you want to have a good time. they both run Steam.
deleted 11y ago
[deleted]
jgallias 11y ago
TLDR; Micah Lee writes an article that takes an in-depth look at how various encryption policies work by default on Windows platforms. No good deed in netsec goes unpunished, so of course Micah is attacked by Ars P.Bright and @SwitftOnSecurity (you know, really reliable people compared to The Intercept :-p).

165 points by kmfrk 11y ago

I'm more confused now than ever. Is it true that all Windows 10 SKUs have full-disk encryption turned on by default? And this automatic full-disk encryption is called "device encryption", which is really the same as BitLocker but without any way for the user to control it? And you can't get BitLocker on the Home edition? If you immediately set up BitLocker, it allows you to save or print your key instead of sending it to Microsoft. But does it use the same key as the default "device encryption" that was already sent to Microsoft? BitLocker doesn't create a new key and re-encrypt the drive? And the TPM automatically loads your key into RAM when the device is powered on, so it's still vulnerable when the device is not in your possession? Are you safe if you (1) create a local account instead of a Microsoft account, (2) use BitLocker instead of device encryption, (3) save your key locally instead of sending it to Microsoft, and (4) require a separate PIN or key to boot the computer in addition to the local Windows account?? It would be helpful to describe exactly how to create a local account, because the Windows 10 setup procedure hides this pretty well. It looks like the only option is to use an existing Microsoft account or create a new one during setup. And it would be great to explain how to create a secondary PIN or key since that doesn't show up in the BitLocker UI until you edit the local policy[1]. [1] https://weikingteh.wordpress.com/2011/04/18/how-to-enable-bitlocker-to-prompt-for-pin-during-startup/ https://weikingteh.wordpress.com/2011/04/18/how-to-enable-bi...

ashmud 11y ago
From only reading the article, it looks like they're shipping BitLocker already on, and that the recovery key Microsoft has is the BitLocker recovery key for the already enabled BitLocker configuration. Turning BitLocker off and back on resets this key. As long as you don't send it to Microsoft after re-enabling, Microsoft won't have it.
- mhurron 11y ago
  > As long as you don't send it to Microsoft after re-enabling, Microsoft won't have it. Unless you have a Home edition of windows, in which case you have no control over it at all. In order to use device encryption you have to sign on with a Microsoft Account and Microsoft will have the key.
  - cmurf 11y ago
    I'm pretty sure that key can be deleted/removed from the online account; of course it's already out of your control, so you're now in a position of trusting the completion of Microsoft's key deletion.
- orillian 11y ago
  Just an aside: I'm running Windows 10 Pro and Bitlocker is off for all 4 of the drives in my machine. This machine was setup from a fresh install of windows 10 shortly after it went live in July. Only a single data point, but apparently there are cases when Microsoft does NOT encrypt the drives.
  - scholia 11y ago
    Disk encryption is enabled on some shipping machines, which is to say, it has been enabled on the three brand new Windows 10 machines I've used. The OEM is responsible for the installation, so I'd assume this is an OEM choice, but obviously I don't know. I didn't notice at first, and really, there's no reason why I should have noticed. Also, I assumed Windows 10 Home didn't come with BitLocker anyway. The Windows 10 security overview on Microsoft TechNet includes the following statements: "Modern Windows devices are increasingly protected with device encryption out of the box and support SSO to seamlessly protect the BitLocker encryption keys from cold boot attacks." "BitLocker supports encrypted hard drives with onboard encryption hardware built in, which allows administrators to use the familiar BitLocker administrative tools to manage them." https://technet.microsoft.com/en-us/library/mt601297%28v=vs.85%29.aspx https://technet.microsoft.com/en-us/library/mt601297%28v=vs....
cmurf 11y ago
Unlikely that the KEK on the TPM is moved into RAM. The TPM would internally decrypt the KEK encrypted DEK, and then use the DEK in RAM (more likely it's just in the CPU using AES-NI, finding it in RAM would be non-trivial assuming the implementation is good). This is compared to e.g. either Linux (LUKS) or OS X where the encrypted DEK is stored on the drive itself (outside of the encrypted volume of course), since neither of them leverage a TPM at the moment.

morganvachon 11y ago

One can replace "Windows computer" with "Android device" and "Microsoft" with "Google" and the article is still factually correct. In other words, how is this any different from Google doing the exact same thing when you sign in to an Android device? On another note, the article gives clear instructions on how to generate a new key without giving it to Microsoft, something that (to the best of my knowledge) is impossible to do on Android or Chrome OS. I get it, it's easy to pick on Microsoft and for good reason. But the hyper focus of this article screams bias.

serge2k 11y ago
> how is this any different from Google doing the exact same thing when you sign in to an Android device It's microsoft, so it's big evil being evil for the sake of being evil and you should hate them for being evil.
zeveb 11y ago
> In other words, how is this any different from Google doing the exact same thing when you sign in to an Android device? When did Google start storing Android full disk encryption passphrases? I certainly haven't heard that it does.
Flimm 11y ago
How do you know that the key for full disk encryption on Android is sent to Google?
- morganvachon 11y ago
  The very fact that we have to ask is what bothers me. Microsoft plainly states that they store the key for full disk encryption, and offer the ability to generate a new key not stored by them (as covered in the article). They also offer BitLocker in their Pro and Enterprise OSes, for even finer grained, user controlled, offline encryption management. On the other hand, Google claims they don't store your Android disk encryption key, yet for all their other services, they do. (They also backtracked on encrypting MicroSD cards, leaving your actual valuable data exposed yet giving you a false sense of security, but that's a discussion for another day). Chrome syncing (and by extension Chrome OS), for example, is decrypted by your Google account login. You can set up a second, separate passphrase for those services, but again the key is definitely stored by them. Given that they have done some really shady stuff in the recent past (Chromium builds that download closed-source binaries after compiling from source and executing for the first time, etc.), I don't trust them as much as I trust Microsoft. And that's not a lot of trust in the first place.

tptacek 11y ago

I'm going out on a limb and suggest that Micah Lee understands why Windows works this way: because Windows is the most popular operating system in the world, and the overwhelming majority of Windows users don't understand how encryption works, and are shocked and dismayed to discover that losing their key more or less forfeits all the data on their disk. It's straightforward to set Bitlocker up so that Microsoft doesn't hold a backup key. Microsoft is doing what their userbase wants them to do. I'm not sure what's interesting about this story.

benevol 11y ago
There really is no ground for any excuses here. Companies like Microsoft and Google doing their part to further the government's agenda for the most complete surveillance and/or control over user data is simply not acceptable. The only valid answer is to switch to Linux. (And don't ask the average user to understand or do anything to prevent that. Default matter.)
- Amezarak 11y ago
  The previous status quo was that law enforcement, criminals, or that guy at Best Buy could by default get all the data off your drive without any effort whatsoever. Microsoft added drive encryption by default with easy recovery if you forget your password - which necessitates Microsoft keeping the recovery key by default. Power users can change these settings. There is no "excuse" here, Microsoft has improved the situation. (And unless things have changed recently, user action is required on virtually every popular Linux distribution except Android to get any drive encryption at all.)
  - benevol 11y ago
    Everybody's talking about encryption these days. People are finally waking up and getting a bit suspicious. Obviously it is convenient for Microsoft to produce an inferior solution which also happens to be what the government wants. What people need is education about the situation and a real solution. Not a "solution" that makes them feel secure, which is what Microsoft sells here.

cmurf 11y ago

I agree that this is better than no encryption. And they're likely escrowing (in most but not all cases) the key for valid UX reasons. The tricky part is doing it without asking the user. Apple used to do optional escrowing on OS X with File Vault 2, but they asked the user. The privacy/surveillance concern comes to play now that China has a law (as of Sunday) saying that tech companies need to be able to hand over keys on demand/request (whatever). Since Microsoft escrows them, they'd be capable of complying. Google and Apple who don't escrow them at all anymore, can't actually comply. Uncertain is whether the law requires them to start a key escrow function. EDIT: And then what if/when U.K. wants access on demand to that escrow service? And then what if/when the U.S. does? If the companies have the keys, it doesn't require a law to get access to them, just a subpoena. It'd require a law to compel the companies to create the escrow capability though.

xenophonf 11y ago

I still wouldn't escrow my disk encryption keys, but I'd be happier if Apple and Microsoft could guarantee that they couldn't access the escrowed keys, kind of like how tarsnap's design means that cpersiva doesn't have access to my backups.

feld 11y ago
Tarsnap's design means the keys never leave your possession; they're never escrowed. You can do this with Microsoft and Apple products, but it's not default.

nivla 11y ago

Hasn't this been discussed multiple times? Microsoft tends to backup your key because the majority base doesn't understand how encryption works. When an average person thinks of passwords, they think there is a way to reset it. Good luck explaining to your grandma why all her favorite photos disappeared when she forgot the password. I think for an average Joe this seems like a good strategy. With the defaults being off if the computer is stolen, all of their data and identity are stolen with it. This atleast acts like a door for an otherwise open house. Advanced users can use another encryption or do what the article suggests to not sent the key to Microsoft.

jcrawfordor 11y ago

> As Green puts it, “Your computer is now only as secure as that database of keys held by Microsoft, which means it may be vulnerable to hackers, foreign governments, and people who can extort Microsoft employees.” One way to think about this: before Win10, my computer was only as secure as the car I sometimes left it in, not to mention that it was only as secure as a bag which I admit I sometimes left out of my sight in coffee shops for seconds at a time. Overall this is a great win. The NSA is not the only actor that FDE secures us from: FDE is more critically protection from anyone who can smash the window of your car or grab your computer in a public place and run. Security is always full of compromises, and MS here is making a compromise to provide protection from the latter group without significantly damaging data availability. Think about this from a C/I/A perspective - that is, Confidentiality/Integrity/Availability as the security industry often discusses. Will-implemented encryption, with as few parties as possible in control of the key (e.g. only the data owner), is excellent for confidentiality and integrity. However, it can have severe impacts on availability if the key is lost. Controlling availability often requires policy and procedure controls (e.g. manually keeping a backup of the key on media stored in a secure place) which cannot simply be automatically enabled like FDE can. Users who are worried about protection from actors like the NSA must take significantly more stringent security measures, including less technical policy and procedural controls, and Windows gives them the capability to do so by re-encrypting without backup to Microsoft and making their own backup which they can manage as they see fit.

dublinben 11y ago
>before Win10, my computer was only as secure as the car I sometimes left it in This was nobody's fault but your own. FDE has been available for Windows for over a decade. You didn't have to wait for Microsoft to (poorly) implement this.
- jcrawfordor 11y ago
  I've actually had FDE for ages (back to when I was using TrueCrypt!), that point was for illustration from the perspective of a normal user, who would have had almost zero exposure to these options. Totally guilty on leaving my computer in coffee shops, though.

dogma1138 11y ago

The keys are stored in your individual OneDrive not a centralized database. OneDrive key integration isn't on by default even if you link a windows live account to your windows ID. Also it's important to note that Microsoft doesn't have your key it has a key recovery element they still need the TPM and your physical drive to recover the full key this is a very very important part as they 1) still need physical access to your machine and 2) cannot arbitrarily encrypt data on your behalf. FDE isn't there to stop government surveillance it's to stop your life from being ruined because you forgot your laptop at a coffee shop or because the guy who you gave your laptop for repairs is a watcher. FDE's biggest problem is that it can fail very easily and very miserably especially when anti-tampering is enabled with external hardware. This solution solves all the usability issues as long as you can get online your laptop will not turn into a paper weight, I can't count the number of times that BitLocker especially 1.0 failed on me when the anti tampering was triggered due to power failure, BIOS update, boot loader reconfiguration and just because it can. With this you get to keep all the anti tampering while still keeping your key relatively secure, OneDrive is probably more secure than pretty much any location you would normal keep the key recovery element yourself (Mine was both my wallet and a scrambled version under the battery when i still have laptops with removable battery). P.S. This is like the 10000's time this has been posted every time some one else discovers this and goes for the clickbait.

chinpokomon 11y ago
This is important. It isn't the same as them possessing the key. They still require physical access and of course with physical access, all bets are off.
geographomics 11y ago
The recovery password doesn't require anything stored in the TPM; if you just had an image of the disk and the recovery password, you could decrypt it. I agree with everything else you stated though.

deleted 11y ago

[deleted]

mtnygard 11y ago

I know that this article is specific to Windows 10. However, it sounds like the same caveats and risks also apply to Apple's iCloud keychain. I'm not trying to excuse one by pointing at the other... I genuinely want to understand any differences in the implementations and the security implications of those differences.

anonbanker 11y ago

So yeah, Linux is stable, and secure. I suggest Calculate Linux or Slackware, if you want to have a good time. they both run Steam.

deleted 11y ago

[deleted]

jgallias 11y ago

TLDR; Micah Lee writes an article that takes an in-depth look at how various encryption policies work by default on Windows platforms. No good deed in netsec goes unpunished, so of course Micah is attacked by Ars P.Bright and @SwitftOnSecurity (you know, really reliable people compared to The Intercept :-p).