I was wondering when a reporter would uncover this.

[groxx@hachyderm.io]

@gsprs @GossiTheDog they also work on ALL hardware, not just ones that Microsoft feels like supporting / have specific TPM features.

[movie2468@mastodon.social]

@GossiTheDog

From my knowledge, the following is true: sign in with MS account will store encryption key. It can be deleted. But is anything cloud really deleted?

Setting up computer as a local machine, from what I know, does not sync encryption keys. They change things frequently and I don’t trust MS, so still use caution.

Setting up a machine on Active Directory in an enterprise setting allows bit locker keys to be written to Active Directory, but I don’t believe it is enabled OOB.

[carpetbomberz@mastodon.online]

@GossiTheDog Time to get a Yubikey and see if they can get around that as a last line of defense. That's if you have admin and can install it yourself. No Yubikey? Good Luck with trying to enter that stupid bit -ocker recovery code. Ask me how I know. I FAFO'D

[x41h@infosec.exchange]

@groxx @GossiTheDog what?? Apple does the same thing which is why nobody should be using cloud accounts on their devices.

[groxx@hachyderm.io]

@x41h @GossiTheDog you don't need an Apple account to set up a Mac.

(at least, last I did it, and still true as far as I can find from a brief search)

[primalmotion@antisocial.ly]

@GossiTheDog shocking..

[mihamarkic@mastodon.social]

@carpetbomberz @GossiTheDog yubi for what?

[mihamarkic@mastodon.social]

@GossiTheDog Isn't bitlocker flawed, though? I remember hackers demonstrating bitlocker bypass when recovering Windows.

[kitsunevixi@sakurajima.social]

@GossiTheDog@cyberplace.social Rob Braxman Tech covered this a few months ago.

[suihkulokki@society.oftrolls.com]

@niknukem @GossiTheDog Which most average users will not. Or if they do, they lose the file before need arises. I mean I hate Microsoft and all the forced cloud stuff, but recovery is a hard problem to solve user-friendly.

[suihkulokki@society.oftrolls.com]

@niknukem @GossiTheDog To put it other way around, having recovery keys automatically stored in Microsoft cloud has probably made A LOT of people happy they could recover their data. A much smaller group is unhappy that Microsoft shared their keys with the spooks.

[utf_7@mastodon.social]

@beastfellow @GossiTheDog remove cryptsetup package

[redsakana@infosec.exchange]

@GossiTheDog Isn't this the default-on-consumer-devices "Device Encryption" branded BitLocker which syncs the recovery key to your MS account and you can view it there if you need it, rather than BitLocker-branded BitLocker that you enable in the legacy control panel and/or with group policies (the latter including options to sync keys to AD and whatever)?

Not that they couldn't grab the key in the latter case too since stealing all the data is totally fine in the AI era, but I think the latter would be somewhat more scandalous than giving the feds the key that you kinda-knowingly already sent to Microsoft.

[niknukem@mastodon.social]

@suihkulokki @GossiTheDog But this group of people knows how to save their key just on a usb drive and not in the cloud.

[raven667@hachyderm.io]

@GossiTheDog It's one of those things that's kind of done in plain sight, but needs someone to think critically about it and reframe it in a few ways so people really understand. Windows won't enable Bitlocker unless it has a way to escrow the key somewhere (OneDrive or AD I think) to handle the case where the boot process changes so you can manually unlock and reseal the TPM key, eg in dual-boot scenarios, or across a firmware update that wasn't initiated from within Windows. This can be done for user-centric reasons and plain escrow is the simplest solution, but it is vulnerable to MS being compromised or compelled by a government, so it's not something you can rely on to protect yourself against a State, just common thieves or human error.

Maybe given the current political climate bringing light to this risk will cause some people to change their risk calculations

[burnitdown@beige.party]

@GossiTheDog

it needs to be known that encryption can only do so much. it's not a blank cheque to say whatever you want over the internet. you can be compelled by one means or another to give up your keys or sit in a cage for a long time.

[adamsdesk@fosstodon.org]

@GossiTheDog Microsoft should never have access to the encryption keys in the first place. A very flawed system indeed.

[tomgag@infosec.exchange]

@GossiTheDog @shufflecake a bit of shameless self-promotion: it looks like we'll be able to launch a prototype for a fully hidden OS using #Shufflecake somewhere this year. And, no, we don't have an option for uploading encryption keys to "the Cloud" 😂 https://shufflecake.net/

[generationx@mstdn.social]

@GossiTheDog nein!, doch!, oh!

[caravantraveller@social.cologne]

@GossiTheDog

Could using VeraCrypt or something similar help to protect your data?