4 ms·

They could just ask before uploading your encryption key to the cloud. Instead they force people to use a Microsoft Account to set up their windows and store th

They could just ask before uploading your encryption key to the cloud. Instead they force people to use a Microsoft Account to set up their windows and store the key without explicit consent

p_ing 9mo ago
Forcing implies there are zero ways to begin with a local only account (or other non-Microsoft Account). That's simply not true.
- bdavbdav 9mo ago
  Disagree. If the path is shrouded behind key presses and commands which are unpublished by MS (and in some instances routes that have been closed), it may as well be.
  - p_ing 9mo ago
    > it may as well be. That defies the definition of "forced". Forced means no option. You can disagree all you want -- but at a technical level, you're incorrect.
    - selfhoster11 9mo ago
      Try doing this as a normies without technical guidance. Technically correct, this time, is not the benchmark.
      - rvnx 9mo ago
        Anyway Microsoft and any software developer can be compelled to practically do anything, you don't want to be blocked in some jurisdictions (even less the US) and the managers do not want to go to jail to protect a terrorist, especially if nobody is going to know that they helped. Some even go that far that they push an update that exfiltrates data from a device (and some even do on their own initiative). And even if you are not legally compelled. Money or influence can go a long way. For example, the fact that HTTPS communications were decipherable by the NSA for almost 20 years, or, whoops, no contract with DoD ("not safe enough"...) Once the data is in the hands of the intelligence services, from a procedure perspective they can choose what to do next (e.g. to officialize this data collection through physical collection of the device, or do nothing and try to find a more juicy target). It's not in the interest of anyone to prevent such collection agreement with governments. It's just Prism v2. So seems normal that Microsoft gives the keys, the same that Cloudflare may give information about you and the others. They don't want to have their lives ruined for you.
    - bad_haircut72 9mo ago
      Im going to shoot you unless you say the magic word - and technically Im not even forcing you into it, you could have said the magic word and got out of it!! Whats the magic word? not telling!
    - bdavbdav 9mo ago
      X didn’t force Y to the ground. If Y had made different choices, worked out more, was stronger, Y could have fought back.
cornholio 9mo ago
That's a crypto architecture design choice, MS opted for the user-friendly key escrow option instead of the more secure strong local key - that requires a competent user setting a strong password and saving recovery codes, understanding the disastrous implication of a key loss etc. Given the abilities of the median MS client, the better choice is not obvious at all, while "protecting from a nation-state adversary" was definitely not one of the goals.
- wobfan 9mo ago
  While you're right, they also went out of their way to prevent competent users from using local accounts and/or not upload their BitLocker keys. I could understand if the default is an online account + automatic key upload, but only if you add an opt-out option to it. It might not even be visible by default, like, idk, hide it somewhere so that you can be sure that the median MS user won't see it and won't think about it. But just fully refusing to allow your users to decide against uploading the encryption key to your servers is evil, straight up.
  - JasonADrury 9mo ago
    You can just ... not select the option to upload your keys to MS? During the setup you get to choose where to store your bitlocker recovery key.
    - _lnrx 9mo ago
      The last time I've installed windows, bitlocker was enabled automatically and the key was uploaded without my consent. Yes, you can opt out of it while manually activating bitlocker, but I find it infuriating that there's no such choice at the system installation process. It's stupid that after system installation a user supposed to renecrypt their system drive if they don't want this.
      - herewulf 9mo ago
        How would you even know that your opt-out request isn't silently ignored? Or your re-encrypted drive's key got backed up to the cloud because an update silently inverted a flag?
JasonADrury 9mo ago
The alternative is just not having FDE on by default, it really isn't "require utterly clueless non-technical users to go through complicated opt-in procedure for backups to avoid losing all their data when they forget their password". And AFAICT, they do ask, even if the flow is clearly designed to get the user to back up their keys online.
- antiframe 9mo ago
  No, encryption keys should never be uploaded to someone else's computer unencrypted. The OOBE should give users a choice between no FDE or FDE with a warning that they should not forget their password or FDE and Microsoft has their key and will be able to recover their disk and would be compelled to share the key with law enforcement. By giving the user the three options with consequences you empower the user to address their threat model how they see fit. There is no good default choice here. The trade offs are too varied.
  - JasonADrury 9mo ago
    Always on FDE with online backups is a perfectly reasonable default. The OOBE does offer the users the choice to not back up their key online, even if it's displayed less prominently. >By giving the user the three options with consequences you empower the user to address their threat model how they see fit. Making it too easy for uneducated users to make poor choices is terrible software design.
- xp84 9mo ago
  > The alternative is just not having FDE on by default yes, it would be. So, the current way, 99% of people are benefitting from knowing their data is secure when very common thefts occur, and 1% of people have the same outcome as if their disk was unencrypted: When they're arrested and their computers seized, the cops have their crime secrets. What's wrong?
- jeroenhd 9mo ago
  Phones have had FDE enabled by default for years. Nobody needs backup keys for those. Of course this feature comes at the cost of no longer being able to have low level control over your device, but this isn't a binary choice.
shevy-java 9mo ago
It makes sense if you consider the possibility of a secret deal between the government and a giant corporation. The deal is that people's data is never secure. It's a nightmare actually.

They could just ask before uploading your encryption key to the cloud. Instead they force people to use a Microsoft Account to set up their windows and store the key without explicit consent

p_ing 9mo ago

Forcing implies there are zero ways to begin with a local only account (or other non-Microsoft Account). That's simply not true.

bdavbdav 9mo ago
Disagree. If the path is shrouded behind key presses and commands which are unpublished by MS (and in some instances routes that have been closed), it may as well be.
- p_ing 9mo ago
  > it may as well be. That defies the definition of "forced". Forced means no option. You can disagree all you want -- but at a technical level, you're incorrect.
  - selfhoster11 9mo ago
    Try doing this as a normies without technical guidance. Technically correct, this time, is not the benchmark.
    - rvnx 9mo ago
      Anyway Microsoft and any software developer can be compelled to practically do anything, you don't want to be blocked in some jurisdictions (even less the US) and the managers do not want to go to jail to protect a terrorist, especially if nobody is going to know that they helped. Some even go that far that they push an update that exfiltrates data from a device (and some even do on their own initiative). And even if you are not legally compelled. Money or influence can go a long way. For example, the fact that HTTPS communications were decipherable by the NSA for almost 20 years, or, whoops, no contract with DoD ("not safe enough"...) Once the data is in the hands of the intelligence services, from a procedure perspective they can choose what to do next (e.g. to officialize this data collection through physical collection of the device, or do nothing and try to find a more juicy target). It's not in the interest of anyone to prevent such collection agreement with governments. It's just Prism v2. So seems normal that Microsoft gives the keys, the same that Cloudflare may give information about you and the others. They don't want to have their lives ruined for you.
  - bad_haircut72 9mo ago
    Im going to shoot you unless you say the magic word - and technically Im not even forcing you into it, you could have said the magic word and got out of it!! Whats the magic word? not telling!
  - bdavbdav 9mo ago
    X didn’t force Y to the ground. If Y had made different choices, worked out more, was stronger, Y could have fought back.

cornholio 9mo ago

That's a crypto architecture design choice, MS opted for the user-friendly key escrow option instead of the more secure strong local key - that requires a competent user setting a strong password and saving recovery codes, understanding the disastrous implication of a key loss etc. Given the abilities of the median MS client, the better choice is not obvious at all, while "protecting from a nation-state adversary" was definitely not one of the goals.

wobfan 9mo ago
While you're right, they also went out of their way to prevent competent users from using local accounts and/or not upload their BitLocker keys. I could understand if the default is an online account + automatic key upload, but only if you add an opt-out option to it. It might not even be visible by default, like, idk, hide it somewhere so that you can be sure that the median MS user won't see it and won't think about it. But just fully refusing to allow your users to decide against uploading the encryption key to your servers is evil, straight up.
- JasonADrury 9mo ago
  You can just ... not select the option to upload your keys to MS? During the setup you get to choose where to store your bitlocker recovery key.
  - _lnrx 9mo ago
    The last time I've installed windows, bitlocker was enabled automatically and the key was uploaded without my consent. Yes, you can opt out of it while manually activating bitlocker, but I find it infuriating that there's no such choice at the system installation process. It's stupid that after system installation a user supposed to renecrypt their system drive if they don't want this.
    - herewulf 9mo ago
      How would you even know that your opt-out request isn't silently ignored? Or your re-encrypted drive's key got backed up to the cloud because an update silently inverted a flag?

JasonADrury 9mo ago

The alternative is just not having FDE on by default, it really isn't "require utterly clueless non-technical users to go through complicated opt-in procedure for backups to avoid losing all their data when they forget their password". And AFAICT, they do ask, even if the flow is clearly designed to get the user to back up their keys online.

antiframe 9mo ago
No, encryption keys should never be uploaded to someone else's computer unencrypted. The OOBE should give users a choice between no FDE or FDE with a warning that they should not forget their password or FDE and Microsoft has their key and will be able to recover their disk and would be compelled to share the key with law enforcement. By giving the user the three options with consequences you empower the user to address their threat model how they see fit. There is no good default choice here. The trade offs are too varied.
- JasonADrury 9mo ago
  Always on FDE with online backups is a perfectly reasonable default. The OOBE does offer the users the choice to not back up their key online, even if it's displayed less prominently. >By giving the user the three options with consequences you empower the user to address their threat model how they see fit. Making it too easy for uneducated users to make poor choices is terrible software design.
xp84 9mo ago
> The alternative is just not having FDE on by default yes, it would be. So, the current way, 99% of people are benefitting from knowing their data is secure when very common thefts occur, and 1% of people have the same outcome as if their disk was unencrypted: When they're arrested and their computers seized, the cops have their crime secrets. What's wrong?
jeroenhd 9mo ago
Phones have had FDE enabled by default for years. Nobody needs backup keys for those. Of course this feature comes at the cost of no longer being able to have low level control over your device, but this isn't a binary choice.

shevy-java 9mo ago

It makes sense if you consider the possibility of a secret deal between the government and a giant corporation. The deal is that people's data is never secure. It's a nightmare actually.