6 ms·

The first issue I have with this feature is: It's opt-out and not opt-in. The second problem I have is that they tell me that neither the snapshots are send to

The first issue I have with this feature is: It's opt-out and not opt-in. The second problem I have is that they tell me that neither the snapshots are send to Microsoft nor are they analyzed on Microsoft's servers, but I do NOT know what happens with the data once stuff got analyzed on an operating system that is phoning home all kinds of information all the time w/o me being able to tell what it is. Not even the enterprise version can disable all the "phone home features" there are and Microsoft doesn't make everything public that they transfer. The third issue is that stuff is stored on my local drive with bitlocker encryption that can be easily circumvented even if they store the keys in a TPM. There is this universal, not well known, only documented in a single file, backdoor to Windows [1] that allows you to gain full control over the system even with secure boot enabled. The possibilities of your boss spying on you will become endless. Not that they aren't already, but this opens a whole new can of worms. [1] - https://download.microsoft.com/download/8/a/2/8a2fb72d-9b96-4e2d-a559-4a27cf905a80/windows-platform-binary-table.docx https://download.microsoft.com/download/8/a/2/8a2fb72d-9b96-...

SoftTalker 2y ago
Sounds like Windows should only be used on an air-gapped network.
- Grimeton 2y ago
  Yeah. This [1] is also a nice read. Even if the page is in dutch, the documents are available as PDFs in english. [1] - https://www.rijksoverheid.nl/documenten/rapporten/2019/06/11/data-protection-impact-assessment-windows-10-enterprise https://www.rijksoverheid.nl/documenten/rapporten/2019/06/11...
Eisenstein 2y ago
What is in that docx file? What is this backdoor that will crack a personal Bitlocker drive encrypted with a PIN? There is (another) 'backdoor' that I know about which is only a backdoor because people don't generally know it exists, but if you use your Windows account to log in with Windows and decrypt the Bitlocker drive, it stores your key in the cloud so that you can unlock it by using the MS account as a 'password reset' feature. I am sure this exists because people don't understand that the question 'I encrypted my drive and forget the password, how do I fix it' is 'you can't', unless you make the encryption worthless by having the key somewhere other people can access. But MS really doesn't care because it also allows businesses to unlock their employee's machines, and a business's concerns are the only concerns MS cares about, and only partially and only sometimes.
- Grimeton 2y ago
  This allows you to write a binary to the system's memory that is then read by Windows on startup, stored on the hard drive and executed with system privileges. The sheer existance of the feature came to light when people began to wonder why Lenovo is able to install their install service every time after they did a clean installation. They went as far as changing the hard drive and the service still reappeared. Asking Lenovo what was going on, Lenovo replied with the information about this and Microsoft had to come up with some documentation. Its existance was neither communicated to the public nor documented anywhere in Microsoft's documentation. Just google the name and be surprised how you cannot find anything about it on Microsoft's pages besides this one document.
  - Eisenstein 2y ago
    Bitlocker has never been marketed as a consumer solution for privacy, it has been marketed as a way for companies to lock down their data if an employee's laptop get stolen or they get fired and don't return it. Anyone that expects that Bitlocker would keep their data private in all cases where they do not personally unlock it is naive.
  - jasomill 2y ago
    While apparently undocumented, you can disable WPBT execution by adding a value to the registry: reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /f /t REG_DWORD /v DisableWpbtExecution /d 1
    - Grimeton 2y ago
      Yeah another reason why I don't like this. This isn't documented either I cannot verify if it's true and if it does what it's supposed to do. The whole feature shouldn't be there in the first place and while WBPT has been documented since Windows 8, similar features have existed way before that and where never documented.
jasomill 2y ago
Why would you trust Secure Boot in the first place on a system where an attacker controls the firmware? And if they don't control the firmware and Secure Boot is enabled, how are they injecting ACPI tables? While I'm no fan of WPBT, I don't see it as much of a security threat.
- Grimeton 2y ago
  Well secure boot only means that the binaries that are executed have been signed and nothing has tainted the boot process. So a USB drive with some signed UEFI binary could just be loaded in the process and wouldn't taint anything.

SoftTalker 2y ago

Sounds like Windows should only be used on an air-gapped network.

Grimeton 2y ago
Yeah. This [1] is also a nice read. Even if the page is in dutch, the documents are available as PDFs in english. [1] - https://www.rijksoverheid.nl/documenten/rapporten/2019/06/11/data-protection-impact-assessment-windows-10-enterprise https://www.rijksoverheid.nl/documenten/rapporten/2019/06/11...

Eisenstein 2y ago

What is in that docx file? What is this backdoor that will crack a personal Bitlocker drive encrypted with a PIN? There is (another) 'backdoor' that I know about which is only a backdoor because people don't generally know it exists, but if you use your Windows account to log in with Windows and decrypt the Bitlocker drive, it stores your key in the cloud so that you can unlock it by using the MS account as a 'password reset' feature. I am sure this exists because people don't understand that the question 'I encrypted my drive and forget the password, how do I fix it' is 'you can't', unless you make the encryption worthless by having the key somewhere other people can access. But MS really doesn't care because it also allows businesses to unlock their employee's machines, and a business's concerns are the only concerns MS cares about, and only partially and only sometimes.

Grimeton 2y ago
This allows you to write a binary to the system's memory that is then read by Windows on startup, stored on the hard drive and executed with system privileges. The sheer existance of the feature came to light when people began to wonder why Lenovo is able to install their install service every time after they did a clean installation. They went as far as changing the hard drive and the service still reappeared. Asking Lenovo what was going on, Lenovo replied with the information about this and Microsoft had to come up with some documentation. Its existance was neither communicated to the public nor documented anywhere in Microsoft's documentation. Just google the name and be surprised how you cannot find anything about it on Microsoft's pages besides this one document.
- Eisenstein 2y ago
  Bitlocker has never been marketed as a consumer solution for privacy, it has been marketed as a way for companies to lock down their data if an employee's laptop get stolen or they get fired and don't return it. Anyone that expects that Bitlocker would keep their data private in all cases where they do not personally unlock it is naive.
- jasomill 2y ago
  While apparently undocumented, you can disable WPBT execution by adding a value to the registry: reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /f /t REG_DWORD /v DisableWpbtExecution /d 1
  - Grimeton 2y ago
    Yeah another reason why I don't like this. This isn't documented either I cannot verify if it's true and if it does what it's supposed to do. The whole feature shouldn't be there in the first place and while WBPT has been documented since Windows 8, similar features have existed way before that and where never documented.

jasomill 2y ago

Why would you trust Secure Boot in the first place on a system where an attacker controls the firmware? And if they don't control the firmware and Secure Boot is enabled, how are they injecting ACPI tables? While I'm no fan of WPBT, I don't see it as much of a security threat.

Grimeton 2y ago
Well secure boot only means that the binaries that are executed have been signed and nothing has tainted the boot process. So a USB drive with some signed UEFI binary could just be loaded in the process and wouldn't taint anything.