I was wondering when a reporter would uncover this.

[amlor@fux.am]

@GossiTheDog @zzt Don't worry, soon copilot will upload EVERYTHING to the cloud anyway, so law enforcement won't need those keys!

[xfox360@wien.rocks]

@shelldozer @GossiTheDog Wouldn't it be crazy if someone generated a million keys for LE to try?

[bytex64@awesome.garden]

@gwire @GossiTheDog I believe you only get the GUI on Professional, but you can set up bitlocker manually with local protectors on Home using the command-line. At least in Windows 10.

[muzicofiel@mastodon.nl]

@bert_hubert @barbarakathmann Zelfs je bitlocker key is niet veilig in #amerika #usa #microsoft willing to engance in support #fascism

[preston@tiggi.es]

@GossiTheDog No, I don't consider BitLocker to be super secure at all, frankly. 🐻 😅

[groxx@hachyderm.io]

@GossiTheDog SO many parts of bitlocker setup just screamed "dark pattern" and "we can access your data, but lol no we won't help you recover it", last time I tried to set it up. and then they locked a ton of the actually-decent stuff away from Home users, because consumers don't deserve safety.

Microsoft is a vile company.

[vol4life8657@tweesecake.social]

@serrebi @GossiTheDog If the FBI has a warrent and they sapena a company for access to data, microsoft feels it's obligated.

[groxx@hachyderm.io]

@gsprs @GossiTheDog they also work on ALL hardware, not just ones that Microsoft feels like supporting / have specific TPM features.

[movie2468@mastodon.social]

@GossiTheDog

From my knowledge, the following is true: sign in with MS account will store encryption key. It can be deleted. But is anything cloud really deleted?

Setting up computer as a local machine, from what I know, does not sync encryption keys. They change things frequently and I don’t trust MS, so still use caution.

Setting up a machine on Active Directory in an enterprise setting allows bit locker keys to be written to Active Directory, but I don’t believe it is enabled OOB.

[carpetbomberz@mastodon.online]

@GossiTheDog Time to get a Yubikey and see if they can get around that as a last line of defense. That's if you have admin and can install it yourself. No Yubikey? Good Luck with trying to enter that stupid bit -ocker recovery code. Ask me how I know. I FAFO'D

[x41h@infosec.exchange]

@groxx @GossiTheDog what?? Apple does the same thing which is why nobody should be using cloud accounts on their devices.

[groxx@hachyderm.io]

@x41h @GossiTheDog you don't need an Apple account to set up a Mac.

(at least, last I did it, and still true as far as I can find from a brief search)

[primalmotion@antisocial.ly]

@GossiTheDog shocking..

[mihamarkic@mastodon.social]

@carpetbomberz @GossiTheDog yubi for what?

[mihamarkic@mastodon.social]

@GossiTheDog Isn't bitlocker flawed, though? I remember hackers demonstrating bitlocker bypass when recovering Windows.

[kitsunevixi@sakurajima.social]

@GossiTheDog@cyberplace.social Rob Braxman Tech covered this a few months ago.

[suihkulokki@society.oftrolls.com]

@niknukem @GossiTheDog Which most average users will not. Or if they do, they lose the file before need arises. I mean I hate Microsoft and all the forced cloud stuff, but recovery is a hard problem to solve user-friendly.

[suihkulokki@society.oftrolls.com]

@niknukem @GossiTheDog To put it other way around, having recovery keys automatically stored in Microsoft cloud has probably made A LOT of people happy they could recover their data. A much smaller group is unhappy that Microsoft shared their keys with the spooks.

[utf_7@mastodon.social]

@beastfellow @GossiTheDog remove cryptsetup package

[redsakana@infosec.exchange]

@GossiTheDog Isn't this the default-on-consumer-devices "Device Encryption" branded BitLocker which syncs the recovery key to your MS account and you can view it there if you need it, rather than BitLocker-branded BitLocker that you enable in the legacy control panel and/or with group policies (the latter including options to sync keys to AD and whatever)?

Not that they couldn't grab the key in the latter case too since stealing all the data is totally fine in the AI era, but I think the latter would be somewhat more scandalous than giving the feds the key that you kinda-knowingly already sent to Microsoft.