6 ms·

One can replace "Windows computer" with "Android device" and "Microsoft" with "Google" and the article is still factually correct. In other words, how is this a

One can replace "Windows computer" with "Android device" and "Microsoft" with "Google" and the article is still factually correct. In other words, how is this any different from Google doing the exact same thing when you sign in to an Android device? On another note, the article gives clear instructions on how to generate a new key without giving it to Microsoft, something that (to the best of my knowledge) is impossible to do on Android or Chrome OS. I get it, it's easy to pick on Microsoft and for good reason. But the hyper focus of this article screams bias.

serge2k 11y ago
> how is this any different from Google doing the exact same thing when you sign in to an Android device It's microsoft, so it's big evil being evil for the sake of being evil and you should hate them for being evil.
zeveb 11y ago
> In other words, how is this any different from Google doing the exact same thing when you sign in to an Android device? When did Google start storing Android full disk encryption passphrases? I certainly haven't heard that it does.
Flimm 11y ago
How do you know that the key for full disk encryption on Android is sent to Google?
- morganvachon 11y ago
  The very fact that we have to ask is what bothers me. Microsoft plainly states that they store the key for full disk encryption, and offer the ability to generate a new key not stored by them (as covered in the article). They also offer BitLocker in their Pro and Enterprise OSes, for even finer grained, user controlled, offline encryption management. On the other hand, Google claims they don't store your Android disk encryption key, yet for all their other services, they do. (They also backtracked on encrypting MicroSD cards, leaving your actual valuable data exposed yet giving you a false sense of security, but that's a discussion for another day). Chrome syncing (and by extension Chrome OS), for example, is decrypted by your Google account login. You can set up a second, separate passphrase for those services, but again the key is definitely stored by them. Given that they have done some really shady stuff in the recent past (Chromium builds that download closed-source binaries after compiling from source and executing for the first time, etc.), I don't trust them as much as I trust Microsoft. And that's not a lot of trust in the first place.
- rdudek 11y ago
  How do we know they don't? But at least with Microsoft, there is a way to remove the encryption key from them. Few years ago, I helped a person unlock their quicken backup file with help of Intuit by calling their support number. User forgot the password he created for the backup and when he tried to restore, he was unable to do it. Intuit was able to unlock that file for him using a master password...
  - schoen 11y ago
    > How do we know they don't? Maybe someone can resolve this question by asking Google, examining Android source code, finding relevant online documentation, or even monitoring what a new Android device does on the network when setting up FDE. I don't feel like this should be a big insoluble mystery for the ages; it's a basic security property of a largely open-source OS that's one of the most popular in the world. We could even ask Micah Lee to do a follow-up article directly addressing other operating systems' FDE key management behavior.
    - beeboop 11y ago
      You can't audit the firmware of the baseband processor, which is capable of sending the key to anyone, so there's not much point of auditing Android/asking Google. You cannot rely on any phone with a closed firmware baseband processor to be 100% secure. It might also come as a surprise to many than most every post-2008 Intel processor is similarly insecure: http://libreboot.org/faq/#intel http://libreboot.org/faq/#intel
      - simoncion 11y ago
        > You cannot rely on any phone with a closed firmware baseband processor to be 100% secure. That's not the question being asked. The question being asked is: "How do you know that the key for full disk encryption on Android is sent to Google?" Every technical person understands that any part of a system that has unrestricted read access to RAM can be used to thwart any FDE scheme. For the purposes of this conversation, it's not useful to talk about this. Doing so is like saying "One can be instantly vaporized by a nuclear bomb, therefore the question is irrelevant." in a conversation about whether aspirin or ibuprofen is safer for occasional relief of minor pain.
schoen 11y ago
Do you have a reference for how Android or ChromeOS handles FDE encryption keys? I don't know what the current behavior is. My impression was that they weren't sent to Google (but I don't have a reference to support this). I think the author of the article meant to compare the Windows behavior with other desktop operating systems, including Microsoft's other desktop operating systems. (I know him and have sometimes talked to him about this topic.)
Amezarak 11y ago
Well, they do get to the reason it's done this way a couple of paragraphs in: > Of course, keeping a backup of your recovery key in your Microsoft account is genuinely useful for probably the majority of Windows users, which is why Microsoft designed the encryption scheme, known as “device encryption,” this way. If something goes wrong and your encrypted Windows computer breaks, you’re going to need this recovery key to gain access to any of your files. Microsoft would rather give their customers crippled disk encryption than risk their data. > “When a device goes into recovery mode, and the user doesn’t have access to the recovery key, the data on the drive will become permanently inaccessible. Based on the possibility of this outcome and a broad survey of customer feedback we chose to automatically backup the user recovery key,” a Microsoft spokesperson told me. “The recovery key requires physical access to the user device and is not useful without it.” The crux of the matter is that the article is trying to confuse readers of the purpose of the encryption. The purpose of Windows "device encryption" is to keep anyone other than you from using your device or getting data off your drive. If you're worried about Microsoft stealing your files, they don't need your key: they just need to wait for you to log in. The only reason Microsoft has the key by default is because users inevitably forget their password and people would be very, very upset if that meant all their data disappeared, just as the above quoted paragraphs suggest. And if you're a power user who really knows what you want, then you don't have to let Microsoft have the key to your device. It sounds like a pretty sane system to me and a non-issue. > Or a law enforcement or spy agency could send Microsoft a request for all data in your account, which would legally compel them to hand over your recovery key, which they could do even if the first thing you do after setting up your computer is delete it. > As Green puts it, “Your computer is now only as secure as that database of keys held by Microsoft, which means it may be vulnerable to hackers, foreign governments, and people who can extort Microsoft employees.” The status quo was that if law enforcement or criminals seized your computer, they by default could access all your files. By encrypting the device by default, they at least added an additional hurdle for law enforcement and made it all but impossible for the common thief. I don't see much to complain about other than it would be nice if Home users had the full Bitlocker feature.
- morganvachon 11y ago
  > It sounds like a pretty sane system to me and a non-issue. That's my take on it as well. It simply amazes me how most people will accept a vendor's total control of their cellphone or tablet, but when it comes to a PC (and PCs are getting smaller and smaller) everyone freaks out over the same thing. And in fact, Microsoft has far less control over a Windows PC than Google and Apple do over their respective phone OSes, especially if you don't use a Microsoft cloud account. > The status quo was that if law enforcement or criminals seized your computer, they by default could access all your files. By encrypting the device by default, they at least added an additional hurdle for law enforcement and made it all but impossible for the common thief. > I don't see much to complain about other than it would be nice if Home users had the full Bitlocker feature. Amen.
anthrowaway33 11y ago
To what end does generating a new Android/ChromeOS key matter? Most users just beam all their data up to Google. LEO and whoever really wants to can get them to hand it over. That key then is really only useful for keeping opportunistic snatchers in Starbucks out. For which it will work just fine. Windows is a different story. You can keep your data from being beamed up. Wanting to keep anyone else out then is a matter of changing the key. A bit of an apples-oranges scenario.

serge2k 11y ago

> how is this any different from Google doing the exact same thing when you sign in to an Android device It's microsoft, so it's big evil being evil for the sake of being evil and you should hate them for being evil.

zeveb 11y ago

> In other words, how is this any different from Google doing the exact same thing when you sign in to an Android device? When did Google start storing Android full disk encryption passphrases? I certainly haven't heard that it does.

Flimm 11y ago

How do you know that the key for full disk encryption on Android is sent to Google?

morganvachon 11y ago
The very fact that we have to ask is what bothers me. Microsoft plainly states that they store the key for full disk encryption, and offer the ability to generate a new key not stored by them (as covered in the article). They also offer BitLocker in their Pro and Enterprise OSes, for even finer grained, user controlled, offline encryption management. On the other hand, Google claims they don't store your Android disk encryption key, yet for all their other services, they do. (They also backtracked on encrypting MicroSD cards, leaving your actual valuable data exposed yet giving you a false sense of security, but that's a discussion for another day). Chrome syncing (and by extension Chrome OS), for example, is decrypted by your Google account login. You can set up a second, separate passphrase for those services, but again the key is definitely stored by them. Given that they have done some really shady stuff in the recent past (Chromium builds that download closed-source binaries after compiling from source and executing for the first time, etc.), I don't trust them as much as I trust Microsoft. And that's not a lot of trust in the first place.
rdudek 11y ago
How do we know they don't? But at least with Microsoft, there is a way to remove the encryption key from them. Few years ago, I helped a person unlock their quicken backup file with help of Intuit by calling their support number. User forgot the password he created for the backup and when he tried to restore, he was unable to do it. Intuit was able to unlock that file for him using a master password...
- schoen 11y ago
  > How do we know they don't? Maybe someone can resolve this question by asking Google, examining Android source code, finding relevant online documentation, or even monitoring what a new Android device does on the network when setting up FDE. I don't feel like this should be a big insoluble mystery for the ages; it's a basic security property of a largely open-source OS that's one of the most popular in the world. We could even ask Micah Lee to do a follow-up article directly addressing other operating systems' FDE key management behavior.
  - beeboop 11y ago
    You can't audit the firmware of the baseband processor, which is capable of sending the key to anyone, so there's not much point of auditing Android/asking Google. You cannot rely on any phone with a closed firmware baseband processor to be 100% secure. It might also come as a surprise to many than most every post-2008 Intel processor is similarly insecure: http://libreboot.org/faq/#intel http://libreboot.org/faq/#intel
    - simoncion 11y ago
      > You cannot rely on any phone with a closed firmware baseband processor to be 100% secure. That's not the question being asked. The question being asked is: "How do you know that the key for full disk encryption on Android is sent to Google?" Every technical person understands that any part of a system that has unrestricted read access to RAM can be used to thwart any FDE scheme. For the purposes of this conversation, it's not useful to talk about this. Doing so is like saying "One can be instantly vaporized by a nuclear bomb, therefore the question is irrelevant." in a conversation about whether aspirin or ibuprofen is safer for occasional relief of minor pain.

schoen 11y ago

Do you have a reference for how Android or ChromeOS handles FDE encryption keys? I don't know what the current behavior is. My impression was that they weren't sent to Google (but I don't have a reference to support this). I think the author of the article meant to compare the Windows behavior with other desktop operating systems, including Microsoft's other desktop operating systems. (I know him and have sometimes talked to him about this topic.)

Amezarak 11y ago

Well, they do get to the reason it's done this way a couple of paragraphs in: > Of course, keeping a backup of your recovery key in your Microsoft account is genuinely useful for probably the majority of Windows users, which is why Microsoft designed the encryption scheme, known as “device encryption,” this way. If something goes wrong and your encrypted Windows computer breaks, you’re going to need this recovery key to gain access to any of your files. Microsoft would rather give their customers crippled disk encryption than risk their data. > “When a device goes into recovery mode, and the user doesn’t have access to the recovery key, the data on the drive will become permanently inaccessible. Based on the possibility of this outcome and a broad survey of customer feedback we chose to automatically backup the user recovery key,” a Microsoft spokesperson told me. “The recovery key requires physical access to the user device and is not useful without it.” The crux of the matter is that the article is trying to confuse readers of the purpose of the encryption. The purpose of Windows "device encryption" is to keep anyone other than you from using your device or getting data off your drive. If you're worried about Microsoft stealing your files, they don't need your key: they just need to wait for you to log in. The only reason Microsoft has the key by default is because users inevitably forget their password and people would be very, very upset if that meant all their data disappeared, just as the above quoted paragraphs suggest. And if you're a power user who really knows what you want, then you don't have to let Microsoft have the key to your device. It sounds like a pretty sane system to me and a non-issue. > Or a law enforcement or spy agency could send Microsoft a request for all data in your account, which would legally compel them to hand over your recovery key, which they could do even if the first thing you do after setting up your computer is delete it. > As Green puts it, “Your computer is now only as secure as that database of keys held by Microsoft, which means it may be vulnerable to hackers, foreign governments, and people who can extort Microsoft employees.” The status quo was that if law enforcement or criminals seized your computer, they by default could access all your files. By encrypting the device by default, they at least added an additional hurdle for law enforcement and made it all but impossible for the common thief. I don't see much to complain about other than it would be nice if Home users had the full Bitlocker feature.

morganvachon 11y ago
> It sounds like a pretty sane system to me and a non-issue. That's my take on it as well. It simply amazes me how most people will accept a vendor's total control of their cellphone or tablet, but when it comes to a PC (and PCs are getting smaller and smaller) everyone freaks out over the same thing. And in fact, Microsoft has far less control over a Windows PC than Google and Apple do over their respective phone OSes, especially if you don't use a Microsoft cloud account. > The status quo was that if law enforcement or criminals seized your computer, they by default could access all your files. By encrypting the device by default, they at least added an additional hurdle for law enforcement and made it all but impossible for the common thief. > I don't see much to complain about other than it would be nice if Home users had the full Bitlocker feature. Amen.

anthrowaway33 11y ago

To what end does generating a new Android/ChromeOS key matter? Most users just beam all their data up to Google. LEO and whoever really wants to can get them to hand it over. That key then is really only useful for keeping opportunistic snatchers in Starbucks out. For which it will work just fine. Windows is a different story. You can keep your data from being beamed up. Wanting to keep anyone else out then is a matter of changing the key. A bit of an apples-oranges scenario.