I was wondering when a reporter would uncover this.

Olivier Langella

@bontchev @GossiTheDog which is why I don't have a Microsoft operating system

Rairii :win3_progman: :win3:

@GossiTheDog "so bitlocker is super secure, right?"

yeah, that's what i thought too, until a few years ago, when most of windows boot environment bugs i found came with bitlocker key dumping or derivation as a side effect

there's more default settings than just that that leads to a less secure configuration

ScoldyFingerWagger

@Yoshi @GossiTheDog

https://keepassxc.org/

tony 🏳️‍⚧️ 🏴 🚴🧗🏻

@GossiTheDog jfc

> Federal investigators in Guam believed the devices held evidence that would help prove individuals handling the island’s Covid unemployment assistance program were part of a plot to steal funds.

Lokalmatator

@GossiTheDog
So, wo auch das Thema dann mal durch ist.

Gut das wir im Bereich der kritischen Infrastruktur auf unabhängige #Software setzen.

Mitex Leo

@GossiTheDog I'm happy with my LUKS encryption

Al & Val's Modern Homesteading

@GossiTheDog PIRACY flaw.

Linuxine

@GossiTheDog for me, Bitlocker is basically Microsoft saying "for your safety, we will encrypt your device, don't you worry, I keep the key". Personally, I prefer to choose and keep the key myself when I want something locked

And now it is even better to learn that the key is not given to the user by default, but provided to the FBI

Benjamin

@Killertomato @GossiTheDog when reading about privacy violation enforcement actions by the FTC there were a lot that would have been resolved by this. Laptops full of patient data stolen from a car, etc.

Honestly it probably mitigates most crimes where an encrypted hard drive avoids the risk. Not all. And not all the non-crime related reasons people care about privacy

Ruston 🇨🇦

@GossiTheDog Another reason I do not use Microsoft. I am forced at work to use it but i try as many work around to avoid it as much as possible. Only another 450 days left of being forced to use it.

squillace

@jt_rebelo @Infoseepage @GossiTheDog that is precisely the point. you CAN possess and NOT backup your keys in a cloud. But sure, it makes it easy for msft to help you out in a pinch. But MSFT could upload an encrypted version -- they do not offer that. Unfortunately.

Utarg of Utarg 🔬🇪🇺🇸🇪🇬🇧🇺🇦

@GossiTheDog Bloody Nora!

Spark Purcell (they/them)

@Infoseepage @GossiTheDog Corporations can't be trusted.They prove that over and over.

squillace

@jt_rebelo @Infoseepage @GossiTheDog altneratively, they could store it in the TEE encrypted drive now, but again, they don't offer that. MSFT can't touch that one. But you have to know; normal users obviously do not.

Dr. Christopher Kunz

@GossiTheDog uploading the BitLocker recovery keys to the MS cloud is not default behavior, is it? Even the Forbes article states that you can opt-out of it (or do you even have to opt-in?).

jaKa Močnik

@christopherkunz @GossiTheDog if you have to to opt out, that makes it default behaviour by definition.

Dr. Christopher Kunz

@jkmcnk Yup, certainly. Firing up my win machine now to see what's up with that.

Katharta

@GossiTheDog IT admins everywhere should have started exploring viable alternatives the second Candy Crush showed up in Windows Enterprise.

If the FBI can obtain someone's Bitlocker keys, that means malicious actors can, too.

There is no such things as a backdoor for only the good guys.

Ben Todd

@GossiTheDog

It's not a flaw. It's a feature. For authority and Microslop.

Tanquist

@GossiTheDog
Maybe that's why our IT department didn't bother to require bitlocker encryption on storage devices I plug into my new PC (actually, I think it was just an oversight).
Anyway it makes my job easier because I occasionally need to exchange data with really old applications on an unconnected XP laptop which can't run bitlocker.