4 ms·
> BitLocker backdoor (MS strongly pushes users to backup keys to the cloud while calling it "encrypted", among security blunders) Even if it's suspicious, it's
by neilalexander 5y ago
> BitLocker backdoor (MS strongly pushes users to backup keys to the cloud while calling it "encrypted", among security blunders)
Even if it's suspicious, it's very easy to understand how this particular thing happened. Key management and handling is surprisingly difficult, even for IT professionals. Look at how many private keys get checked into GitHub on a regular basis.
You have to understand what the keys do and how they protect your data. You need to know that your data is really really gone if you lose them. You need to understand what happens if someone else gets their hands on your keys. You need to keep copies of the backup keys but not too many copies because that's also insecure. You need to understand what powers you are giving another person by asking them to keep a copy of your keys. You need to understand who it is safe to hand your keys over to. You need to be able to tell when you are being tricked into handing your keys over to someone or something malicious.
Some of us may understand all of this but there are many people in the world from whom it is simply unreasonable to expect that. The same people who create new Facebook accounts because they forgot the password to their old one, or take their computer to a repair shop if their emails won't download. BitLocker key backup is about the best way that Microsoft Customer Service or your organisation IT helpdesk can turn around and say "well actually, yes, we can help with this" rather than leaving users to suffer consequences they probably didn't even know about.
- hulitu 5y ago> BitLocker key backup is about the best way that Microsoft Customer Service or your organisation IT helpdesk can turn around and say "well actually, yes, we can help with this" rather than leaving users to suffer consequences they probably didn't even know about. This is the best way for Microsoft. They have the keys to data. The best way for other people is education. Just as you lit a match when you're a child and get burned and you learn that fire burns, just like this you can teach people about their data and the consequences of giving it to others. This, of course, does not work because (in this case) Microsoft has a conflict of interest. They want your data. I'm astonished how my company talks about information security when almost everything they have is in the cloud. Microsoft has the emails, Microsoft has the code. Yes they do claim it is secure but the keys are only accessible by the Microsoft OS. The funny thing is that capitalism was all about property. "I own my {house, computer, car}." I'm really curious how this will evolve in the long term when noone will own anything. A new era of "digital slavery" ?