4 ms·

I don't believe BitLocker can be considered secure. Cross-post (mine) from the previous thread: > Not "backdoors" but it seems Microsoft stores the BitLocker d

• danparsonson 12y ago
  > Not "backdoors" but it seems Microsoft stores the BitLocker decryption key, based on this leaked slide (just found on twitter): https://twitter.com/TheBlogPirate/status/471759810644283392/.. https://twitter.com/TheBlogPirate/status/471759810644283392/.... That looks dubious to me - if you were creating a slide, would you use 90-degree-rotated text? > edit: Confirmed Microsoft stores your recovery key on their servers if you're not connected to a domain: http://windows.microsoft.com/en-AU/windows-8/bitlocker-recov.. http://windows.microsoft.com/en-AU/windows-8/bitlocker-recov.... "There are several locations in which your BitLocker recovery key might have been saved" - emphasis mine - doesn't this mean they'll store the key if you log into "Your Microsoft account"? I have to admit I don't use Windows 8 so I don't know if this is mandatory or not? What about Windows 7?
  • andyjohnson0 12y ago
    Using a Microsoft account for login is not mandatory on Windows 8.
    • makomk 12y ago
      It's not mandatory to use a Microsoft account for login, but they've been hiding the option not to in increasingly obscure locations in the installer. At one point, the easiest way to do it was apparently to just unplug your internet connection!
  • MichaelGG 12y ago
    Maybe Microsoft asks or somehow prompts the user to back up their encryption keys? I mean, a user-focused OS certainly wouldn't include such a feature, right?
    • danparsonson 12y ago
      The question was not whether or not they might do it but whether or not they always did it. If a user is required to submit their encryption key to a third party for storage then the encryption solution is limited by their trust in the third party.
  • andrewfong 12y ago
    Previous poster's confirmation is misleading -- it does not appear to be mandatory. I just went through the process on my Windows 8 machine, and you can choose to save to the recovery key to a file or print it out in lieu of storing it with your Microsoft Account (http://imgur.com/J0zk6I5 http://imgur.com/J0zk6I5). Two caveats: (1) It's possible Microsoft could choose to store the keys online regardless of what the user picks, but it's certainly not their official stance. (2) Microsoft does automatically store keys online if you're using "Device Encryption" in Windows 8.1 (http://arstechnica.com/information-technology/2013/10/windows-8-1-includes-seamless-automatic-disk-encryption-if-your-pc-supports-it/ http://arstechnica.com/information-technology/2013/10/window...). This uses Bitlocker code but is distinct from using Bitlocker itself though -- i.e. if you do a vanilla Bitlocker encryption, your system should not send the keys to MS without a user (or admin) explicitly telling it to.
• papaf 12y ago
  In the Greenwald book (No Place to Hide) he describes how Microsoft made a real effort with Skype and their Dropbox clone to open them up to the NSA. Now I have read these revelations, I feel that not trusting Microsoft is a sensible default.
  • moe 12y ago
    Now I have read these revelations, I feel that not trusting Microsoft is a sensible default. You make it sound as if trusting Microsoft was ever an option to begin with...