I was wondering when a reporter would uncover this.

[suihkulokki@society.oftrolls.com]

@niknukem @GossiTheDog Which most average users will not. Or if they do, they lose the file before need arises. I mean I hate Microsoft and all the forced cloud stuff, but recovery is a hard problem to solve user-friendly.

[suihkulokki@society.oftrolls.com]

@niknukem @GossiTheDog To put it other way around, having recovery keys automatically stored in Microsoft cloud has probably made A LOT of people happy they could recover their data. A much smaller group is unhappy that Microsoft shared their keys with the spooks.

[utf_7@mastodon.social]

@beastfellow @GossiTheDog remove cryptsetup package

[redsakana@infosec.exchange]

@GossiTheDog Isn't this the default-on-consumer-devices "Device Encryption" branded BitLocker which syncs the recovery key to your MS account and you can view it there if you need it, rather than BitLocker-branded BitLocker that you enable in the legacy control panel and/or with group policies (the latter including options to sync keys to AD and whatever)?

Not that they couldn't grab the key in the latter case too since stealing all the data is totally fine in the AI era, but I think the latter would be somewhat more scandalous than giving the feds the key that you kinda-knowingly already sent to Microsoft.

[niknukem@mastodon.social]

@suihkulokki @GossiTheDog But this group of people knows how to save their key just on a usb drive and not in the cloud.

[raven667@hachyderm.io]

@GossiTheDog It's one of those things that's kind of done in plain sight, but needs someone to think critically about it and reframe it in a few ways so people really understand. Windows won't enable Bitlocker unless it has a way to escrow the key somewhere (OneDrive or AD I think) to handle the case where the boot process changes so you can manually unlock and reseal the TPM key, eg in dual-boot scenarios, or across a firmware update that wasn't initiated from within Windows. This can be done for user-centric reasons and plain escrow is the simplest solution, but it is vulnerable to MS being compromised or compelled by a government, so it's not something you can rely on to protect yourself against a State, just common thieves or human error.

Maybe given the current political climate bringing light to this risk will cause some people to change their risk calculations

[burnitdown@beige.party]

@GossiTheDog

it needs to be known that encryption can only do so much. it's not a blank cheque to say whatever you want over the internet. you can be compelled by one means or another to give up your keys or sit in a cage for a long time.

[adamsdesk@fosstodon.org]

@GossiTheDog Microsoft should never have access to the encryption keys in the first place. A very flawed system indeed.

[tomgag@infosec.exchange]

@GossiTheDog @shufflecake a bit of shameless self-promotion: it looks like we'll be able to launch a prototype for a fully hidden OS using #Shufflecake somewhere this year. And, no, we don't have an option for uploading encryption keys to "the Cloud" 😂 https://shufflecake.net/

[generationx@mstdn.social]

@GossiTheDog nein!, doch!, oh!

[caravantraveller@social.cologne]

@GossiTheDog

Could using VeraCrypt or something similar help to protect your data?