News for hackers. Stuff that matters.
Re:Keyhole – Forge own Windows Store licenses by r2_pilot on Saturday September 07, 2024 @10:04AM (#41474008)
>> Does tying those keys to your MS account fix that failure method? >Yes. Bitlocker recovery keys are escrowed to the Microsoft account.

Which then opens the door to other attack vectors, even government.

Re:Keyhole – Forge own Windows Store licenses by vel0city on Saturday September 07, 2024 @11:34AM (#41474473)
As opposed to just not encrypting their data at all and letting everyone who ends up with the drive have their data.

So one scenario, everyone can access the data if they get the drive. The other, the government might get Microsoft to release the encryption keys.

Re:Keyhole – Forge own Windows Store licenses by r2_pilot on Saturday September 07, 2024 @11:52AM (#41474569)
>As opposed to just not encrypting their data at all and letting everyone who ends up with the drive have their data.

You are presenting a false dilemma where either Bitlocker is in use or the drive is entirely unencrypted; there are other ways to ensure data integrity in the face of physical compromise.

Re:Keyhole – Forge own Windows Store licenses by whyoh on Saturday September 07, 2024 @12:35PM (#41474799)
1. It's not a false dilemma, it's more of a question of how to handle the "average Joe" user that doesn't know how to store encryption keys. I don't like how this automatic encryption is implemented, by the way, but sending the keys to MS servers is not the worst idea ever.

2. Bitlocker can totally be used without a MS account and without sending keys anywhere and without TPM... But seeing how most people fail to RTFM we're back to point 1.

Re:Keyhole – Forge own Windows Store licenses by doubled112 on Saturday September 07, 2024 @10:43AM (#41474193)
I’d imagine most people would like some insurance in the event of loss or theft, but are not worried about government.

I’m vulnerable to the $8 wrench attack, but enjoy knowing it is only a VISA problem if I leave it a laptop the bus.

Re:Keyhole – Forge own Windows Store licenses by r2_pilot on Saturday September 07, 2024 @11:36AM (#41474490)
I mention that only because it's one avenue. I figured obviously on a place like Hacker News that malicious agents aside from government could also compromise the security of 3rd party-held keys; as always security is a matter of difficult tradeoffs and anticipated threat categories.
Re:Keyhole – Forge own Windows Store licenses by seabass-labrax on Saturday September 07, 2024 @12:44PM (#41474849)
I'm genuinely curious to know how VISA helps (or doesn't) in your analogy - what is a 'VISA problem'?
Re:Keyhole – Forge own Windows Store licenses by doubled112 on Saturday September 07, 2024 @01:13PM (#41474988)
Mostly a joke, but I swipe a card and the problem goes away. No need to worry anymore.
Re:Keyhole – Forge own Windows Store licenses by seabass-labrax on Sunday September 08, 2024 @07:10PM (#41484031)
Ah, thank you; I get it now: you don't need to worry about data theft because the drive was encrypted, so the only remaining problem is buying a replacement - a 'VISA' problem. I rather like that way of putting it; I might use it myself :)
Re:Keyhole – Forge own Windows Store licenses by vel0city on Saturday September 07, 2024 @01:55PM (#41475258)
VISA as in the credit card not a travel permit