3 ms·

From only reading the article, it looks like they're shipping BitLocker already on, and that the recovery key Microsoft has is the BitLocker recovery key for th

by ashmud 11y ago

From only reading the article, it looks like they're shipping BitLocker already on, and that the recovery key Microsoft has is the BitLocker recovery key for the already enabled BitLocker configuration. Turning BitLocker off and back on resets this key. As long as you don't send it to Microsoft after re-enabling, Microsoft won't have it.

mhurron 11y ago
> As long as you don't send it to Microsoft after re-enabling, Microsoft won't have it. Unless you have a Home edition of windows, in which case you have no control over it at all. In order to use device encryption you have to sign on with a Microsoft Account and Microsoft will have the key.
- cmurf 11y ago
  I'm pretty sure that key can be deleted/removed from the online account; of course it's already out of your control, so you're now in a position of trusting the completion of Microsoft's key deletion.
orillian 11y ago
Just an aside: I'm running Windows 10 Pro and Bitlocker is off for all 4 of the drives in my machine. This machine was setup from a fresh install of windows 10 shortly after it went live in July. Only a single data point, but apparently there are cases when Microsoft does NOT encrypt the drives.
- scholia 11y ago
  Disk encryption is enabled on some shipping machines, which is to say, it has been enabled on the three brand new Windows 10 machines I've used. The OEM is responsible for the installation, so I'd assume this is an OEM choice, but obviously I don't know. I didn't notice at first, and really, there's no reason why I should have noticed. Also, I assumed Windows 10 Home didn't come with BitLocker anyway. The Windows 10 security overview on Microsoft TechNet includes the following statements: "Modern Windows devices are increasingly protected with device encryption out of the box and support SSO to seamlessly protect the BitLocker encryption keys from cold boot attacks." "BitLocker supports encrypted hard drives with onboard encryption hardware built in, which allows administrators to use the familiar BitLocker administrative tools to manage them." https://technet.microsoft.com/en-us/library/mt601297%28v=vs.85%29.aspx https://technet.microsoft.com/en-us/library/mt601297%28v=vs....
  - scholia 11y ago
    > Also, I assumed Windows 10 Home didn't come with BitLocker anyway. Apparently it's "device encryption" but it's not BitLocker. And while it's optional at the moment, it becomes compulsory in summer 2016.

by ashmud 11y ago

mhurron 11y ago

> As long as you don't send it to Microsoft after re-enabling, Microsoft won't have it. Unless you have a Home edition of windows, in which case you have no control over it at all. In order to use device encryption you have to sign on with a Microsoft Account and Microsoft will have the key.

cmurf 11y ago
I'm pretty sure that key can be deleted/removed from the online account; of course it's already out of your control, so you're now in a position of trusting the completion of Microsoft's key deletion.

orillian 11y ago

Just an aside: I'm running Windows 10 Pro and Bitlocker is off for all 4 of the drives in my machine. This machine was setup from a fresh install of windows 10 shortly after it went live in July. Only a single data point, but apparently there are cases when Microsoft does NOT encrypt the drives.

scholia 11y ago
Disk encryption is enabled on some shipping machines, which is to say, it has been enabled on the three brand new Windows 10 machines I've used. The OEM is responsible for the installation, so I'd assume this is an OEM choice, but obviously I don't know. I didn't notice at first, and really, there's no reason why I should have noticed. Also, I assumed Windows 10 Home didn't come with BitLocker anyway. The Windows 10 security overview on Microsoft TechNet includes the following statements: "Modern Windows devices are increasingly protected with device encryption out of the box and support SSO to seamlessly protect the BitLocker encryption keys from cold boot attacks." "BitLocker supports encrypted hard drives with onboard encryption hardware built in, which allows administrators to use the familiar BitLocker administrative tools to manage them." https://technet.microsoft.com/en-us/library/mt601297%28v=vs.85%29.aspx https://technet.microsoft.com/en-us/library/mt601297%28v=vs....
- scholia 11y ago
  > Also, I assumed Windows 10 Home didn't come with BitLocker anyway. Apparently it's "device encryption" but it's not BitLocker. And while it's optional at the moment, it becomes compulsory in summer 2016.