No, what people are saying is the average user doesn't store a lot of data on their phone except what they have backed up through a cloud service.
The average user has a ton of data that isn't on the cloud on their local machine, losing all of that because they forgot their password isn't something that the user expects so adding encryption with no backdoor hurts the average user more than it helps.
Bitlocker doesn't back up the keys anymore than you ask it to and it easily enabled if you care about the NSA being able to get ahold of them.
> Much more limited against someone who can get your computer/tablet/phone and guess a password or some security questions. Don't jump straight to the NSA when your threat model is adequately met by someone who knows that your password is 'Kitty123'.
If they know your password no amount of device encryption will protect you, that is why he is ignoring them.
I can set a 128-bit equivalent password on my computer. I don't know how to ensure that Microsoft's cloud provides equivalent security, given the existence of password recovery mechanisms (SMS, email, security questions and social engineering of MS customer service reps).
But I'm not that familiar with Microsoft's cloud operations. If there is a way, let me know.
I wouldn't grant that. The whole context of this discussion is related to Microsoft's SkyDrive, which is a free cloud service offered to MS customers. It even provides photo and document backup if you want it. I suppose it may not be as developed as iCloud (for iOS devices) but I don't see a principled difference in the two systems.
Moreover, the purpose of the recovery key doesn't seem to be related to data backup. If your disk fails or you lose your device then there are two cases:
1. You backed up your data, either to the cloud or to an external backup disk. In this case the device encryption and recovery keys become irrelevant. That's because device encryption is only applied to data on internal drives.
2. You didn't back up your data. In this case your recovery keys are useless, since you don't have the data.
So it seems like the use-case for recovery keys is primarily for situations where the user has forgotten his/her password. Saying that Apple/Google don't need to care about this because they have cloud backup (and implicitly MS doesn't) seems like a bit of a cop out.
> In this context "much more limited" is against: almost every government in the world, private individuals, and against private companies. So, what, like 98%+ of the world's population?
Much more limited against someone who can get your computer/tablet/phone and guess a password or some security questions. Don't jump straight to the NSA when your threat model is adequately met by someone who knows that your password is 'Kitty123'.