4 ms·

Microsoft Gave FBI Keys to Unlock Encrypted Data, Exposing Major Privacy Flaw

62 points by _____k 9mo ago

fuzzfactor 9mo ago
You all did know that the idea of a Microsoft account was a security & privacy compromise from day zero of its conception, right?
- jqpabc123 9mo ago
  Yes; and none of my computers have one. Contrary to popular myth, it is relatively easy to install Win11 Pro without one.
  - josephcsible 9mo ago
    A constant cat-and-mouse game of Microsoft disabling every method to do so as soon as they become somewhat popular is not "relatively easy".
    - jqpabc123 9mo ago
      Really? I haven't had any problems, even with computers that don't meet the official hardware requirements. Download the Win11 Pro ISO, extract it to a USB drive and then execute the command below from it for a totally automated install that bypasses all the BS. .\setup.exe /product server /auto upgrade /EULA accept /migratedrivers all /ShowOOBE none /Compat IgnoreWarning /Telemetry Disable You're welcome! PS: I know it says "server" but when upgrading a desktop machine, desktop is what you will get --- minus a lot of BS.
      - josephcsible 9mo ago
        I believe you that that way works today, but once knowledge of it starts to spread, I expect Microsoft to break it, just like they previously broke Shift+F10 "oobe\bypassnro" and "start ms-cxh:localonly".
        jqpabc123 9mo ago
        It has worked all along and MS can't break it because I have the ISO that it works with. It's unlikely it can be broken without totally abandoning the server market and disrupting a lot of existing installations --- which would be a marketing disaster.
        alt227 9mo ago
        There will always be a way to create local accounts in Windows because they are intrinsic to how windows actually works.
        josephcsible 9mo ago
        There may always be a way, but every few months the existing way will stop working and people will need to discover a new way.
        alt227 9mo ago
        Thats exactly my point, they will keep closing loopholes but they will never truly stop people doing it without removing local accounts completely, which they cant do.
- jmclnx 9mo ago
  Well I would say this should be true for most people here. I expect the same for Apple too. The big question is, when will these keys hit the wild ? Since they exist, eventually they will get out there. We all know, if you want real security, there are much better OSs.
  - dagmx 9mo ago
    Why would you expect Apple to have the keys? They famously fought the FBI on the grounds of not having access to the keys themselves. Good engineering practices say that you shouldn’t even find yourself in the position of having the keys. And what “better OS” pushes you to encrypted drives on setup? Most Linux distros don’t.
jqpabc123 9mo ago
... does not possess the forensic tools to break into devices encrypted with Microsoft BitLocker Nice intel to have. Now, all that is needed for reasonable security is to avoid storing the key in the cloud. Duhhh. Basic rule: Not your hardware (computer/drive), not your data. Never store anything on someone else's hardware that you need to maintain full control over. But, but, but encryption? It helps but encryption does not guarantee full access when you don't control the hardware.
- OptionOfT 9mo ago
  They don't have the tools but for 99% of the people who have laptop with device encryption, they mandate Microsoft Accounts, and guess where the keys are uploaded to? Thats right, https://aka.ms/recoverykey https://aka.ms/recoverykey. You don't need to build backdoors when you store a copy of the key.
  - jqpabc123 9mo ago
    they mandate Microsoft Accounts I don't use these. See post below.
- general1465 9mo ago
  > Nice intel to have. Now, all that is needed for reasonable security is to avoid storing the key in the cloud. Duhhh. You can go one step further. Encrypt your computer, store keys on the cloud, then encrypt your computer again but store keys into a file. You can see key ID on Microsoft Live account. Now you won't even look suspicious.
romanovcode 9mo ago
The flaw is that they had those keys to begin with. What's the point of encryption if key is available and free to use? Same with iCloud Email. Privacy cannot come from human-made laws and regulations because they get abused on they change. Privacy comes from mathematics which do not care for laws and regulations.
- dogma1138 9mo ago
  The main threat model here is a stolen/lost device or an unscrupulous repair shop not a government agency with a warrant. You also do not have to backup keys in the cloud, however for most users it’s the best solution since for them data recovery in case of a hardware failure is more important than resiliency against state level adversaries.
  - toomuchtodo 9mo ago
    I am an Apple ecosystem lifetime participant. I have recovery and legacy contacts. What I would love is for those contacts to have the encryption key(s) for my data shared with them so they can provide me with recovery options if needed, but Apple cannot. Certainly, nation state actors could pursue those people to obtain access to key material, but that is a different hill to climb than simply sending requests to Apple, especially for contacts outside of the jurisdiction or nation state reach. Perhaps Shamir's secret sharing would be a component of such an option (you need X out of Y trusted contacts to recover, 2 out of 3 for easy mode, 3 out of 5 for hard mode).
- eddyg 9mo ago
  Don't include iCloud in this. https://www.youtube.com/watch?v=BLGFriOKz6U&t=1993s https://www.youtube.com/watch?v=BLGFriOKz6U&t=1993s
  - dogma1138 9mo ago
    Apple can recover your keys also unless you enable ADP. With MSFT cloud backup of keys is an opt-in. With Apple it’s an opt-out.
OutOfHere 9mo ago
The part that I was shocked to read is that Apple is equally unsafe.
- jqpabc123 9mo ago
  Just wait until you discover that Apple is not so private either. https://appleinsider.com/articles/22/11/12/apple-getting-sued-over-app-store-user-data-collection https://appleinsider.com/articles/22/11/12/apple-getting-sue... https://slnt.com/blogs/insights/is-apple-selling-data-find-out-the-truth-and-what-to-do-about-it https://slnt.com/blogs/insights/is-apple-selling-data-find-o...
- dogma1138 9mo ago
  You can enable ADP (unless you’re in the UK) and then they can’t recover the key either. But the risk then is that if you lose the device your data is gone for good (unless you have a backup and that opens you up for a whole other list of potential threats).
  - OutOfHere 9mo ago
    Oh I would never use iCloud. The concern is more about Apple's full disk encryption. Regarding my own encrypted backups, the choices there are so diverse that Apple doesn't factor in.
cf100clunk 9mo ago
https://archive.ph/0OaJ9 https://archive.ph/0OaJ9

62 points by _____k 9mo ago

You all did know that the idea of a Microsoft account was a security & privacy compromise from day zero of its conception, right?

jqpabc123 9mo ago
Yes; and none of my computers have one. Contrary to popular myth, it is relatively easy to install Win11 Pro without one.
- josephcsible 9mo ago
  A constant cat-and-mouse game of Microsoft disabling every method to do so as soon as they become somewhat popular is not "relatively easy".
  - jqpabc123 9mo ago
    Really? I haven't had any problems, even with computers that don't meet the official hardware requirements. Download the Win11 Pro ISO, extract it to a USB drive and then execute the command below from it for a totally automated install that bypasses all the BS. .\setup.exe /product server /auto upgrade /EULA accept /migratedrivers all /ShowOOBE none /Compat IgnoreWarning /Telemetry Disable You're welcome! PS: I know it says "server" but when upgrading a desktop machine, desktop is what you will get --- minus a lot of BS.
    - josephcsible 9mo ago
      I believe you that that way works today, but once knowledge of it starts to spread, I expect Microsoft to break it, just like they previously broke Shift+F10 "oobe\bypassnro" and "start ms-cxh:localonly".
      - jqpabc123 9mo ago
        It has worked all along and MS can't break it because I have the ISO that it works with. It's unlikely it can be broken without totally abandoning the server market and disrupting a lot of existing installations --- which would be a marketing disaster.
      - alt227 9mo ago
        There will always be a way to create local accounts in Windows because they are intrinsic to how windows actually works.
        josephcsible 9mo ago
        There may always be a way, but every few months the existing way will stop working and people will need to discover a new way.
        alt227 9mo ago
        Thats exactly my point, they will keep closing loopholes but they will never truly stop people doing it without removing local accounts completely, which they cant do.
jmclnx 9mo ago
Well I would say this should be true for most people here. I expect the same for Apple too. The big question is, when will these keys hit the wild ? Since they exist, eventually they will get out there. We all know, if you want real security, there are much better OSs.
- dagmx 9mo ago
  Why would you expect Apple to have the keys? They famously fought the FBI on the grounds of not having access to the keys themselves. Good engineering practices say that you shouldn’t even find yourself in the position of having the keys. And what “better OS” pushes you to encrypted drives on setup? Most Linux distros don’t.

jqpabc123 9mo ago

... does not possess the forensic tools to break into devices encrypted with Microsoft BitLocker Nice intel to have. Now, all that is needed for reasonable security is to avoid storing the key in the cloud. Duhhh. Basic rule: Not your hardware (computer/drive), not your data. Never store anything on someone else's hardware that you need to maintain full control over. But, but, but encryption? It helps but encryption does not guarantee full access when you don't control the hardware.

OptionOfT 9mo ago
They don't have the tools but for 99% of the people who have laptop with device encryption, they mandate Microsoft Accounts, and guess where the keys are uploaded to? Thats right, https://aka.ms/recoverykey https://aka.ms/recoverykey. You don't need to build backdoors when you store a copy of the key.
- jqpabc123 9mo ago
  they mandate Microsoft Accounts I don't use these. See post below.
general1465 9mo ago
> Nice intel to have. Now, all that is needed for reasonable security is to avoid storing the key in the cloud. Duhhh. You can go one step further. Encrypt your computer, store keys on the cloud, then encrypt your computer again but store keys into a file. You can see key ID on Microsoft Live account. Now you won't even look suspicious.

romanovcode 9mo ago

The flaw is that they had those keys to begin with. What's the point of encryption if key is available and free to use? Same with iCloud Email. Privacy cannot come from human-made laws and regulations because they get abused on they change. Privacy comes from mathematics which do not care for laws and regulations.

dogma1138 9mo ago
The main threat model here is a stolen/lost device or an unscrupulous repair shop not a government agency with a warrant. You also do not have to backup keys in the cloud, however for most users it’s the best solution since for them data recovery in case of a hardware failure is more important than resiliency against state level adversaries.
- toomuchtodo 9mo ago
  I am an Apple ecosystem lifetime participant. I have recovery and legacy contacts. What I would love is for those contacts to have the encryption key(s) for my data shared with them so they can provide me with recovery options if needed, but Apple cannot. Certainly, nation state actors could pursue those people to obtain access to key material, but that is a different hill to climb than simply sending requests to Apple, especially for contacts outside of the jurisdiction or nation state reach. Perhaps Shamir's secret sharing would be a component of such an option (you need X out of Y trusted contacts to recover, 2 out of 3 for easy mode, 3 out of 5 for hard mode).
eddyg 9mo ago
Don't include iCloud in this. https://www.youtube.com/watch?v=BLGFriOKz6U&t=1993s https://www.youtube.com/watch?v=BLGFriOKz6U&t=1993s
- dogma1138 9mo ago
  Apple can recover your keys also unless you enable ADP. With MSFT cloud backup of keys is an opt-in. With Apple it’s an opt-out.

OutOfHere 9mo ago

The part that I was shocked to read is that Apple is equally unsafe.

jqpabc123 9mo ago
Just wait until you discover that Apple is not so private either. https://appleinsider.com/articles/22/11/12/apple-getting-sued-over-app-store-user-data-collection https://appleinsider.com/articles/22/11/12/apple-getting-sue... https://slnt.com/blogs/insights/is-apple-selling-data-find-out-the-truth-and-what-to-do-about-it https://slnt.com/blogs/insights/is-apple-selling-data-find-o...
dogma1138 9mo ago
You can enable ADP (unless you’re in the UK) and then they can’t recover the key either. But the risk then is that if you lose the device your data is gone for good (unless you have a backup and that opens you up for a whole other list of potential threats).
- OutOfHere 9mo ago
  Oh I would never use iCloud. The concern is more about Apple's full disk encryption. Regarding my own encrypted backups, the choices there are so diverse that Apple doesn't factor in.

cf100clunk 9mo ago

https://archive.ph/0OaJ9 https://archive.ph/0OaJ9