3 ms·
>Be aware that in the case of Bitlocker specifically Microsoft "conveniently" saves your encryption key on their "cloud", so you don't really need the TPM to de
by Arnavion 4y ago
>Be aware that in the case of Bitlocker specifically Microsoft "conveniently" saves your encryption key on their "cloud", so you don't really need the TPM to decrypt stuff, which of course goes completely against the purpose of storing the key there in the first place.
What MS stores in the cloud is not the encryption key but a recovery key. Obviously a recovery key can also be used to perform the decryption, but it has the benefit that it's generated by the system to be of high entropy, as opposed to a human-chosen password.
If you're against FDE recovery keys I assume you're also against 2FA recovery codes.
- 0cf8612b2e1e 4y agoI think the concern is that Microsoft does this automatically and keeps a copy. A backup under my control is a completely different matter.
- Arnavion 4y agoThe rest of their post makes it clear that they consider any keys that are not backed by their TPM to be undesirable.