Recently Bought a Windows Computer? Microsoft Probably Has Your Encryption Key

The only valid answer is to switch to Linux.

(And don't ask the average user to understand or do anything to prevent that. Default matter.)

Which he states on his own, and with a quote from an unnamed Microsoft representative, starting on the 7th paragraph:

> Of course, keeping a backup of your recovery key in your Microsoft account is genuinely useful for probably the majority of Windows users, which is why Microsoft designed the encryption scheme...

But, I agree with you. This is pretty much a non-story. One might have to jump through one more hoop to setup BitLocker without sending the key to any third party, but it's essentially the same as the default of sending your FileVault key to Apple for the easiest backup option.

Since Microsoft presumably doesn't have the data, they get little value from holding the key. However, I would never copy a key without telling anyone.

Device encryption tends to be terrible, and as Micah says you can't ever change the storage option for the recovery key. It's automatically tied to the Microsoft account.

If Windows Home had BitLocker, this wouldn't be a problem. But as with most of Microsoft'/Nadella's moves lately, they seem to believe they know best not for 99% of their users, but for 100% of them. That's how we got encryption keys that can only get stored in Microsoft/NSA's datacenters, telemetry services that you can never truly stop, and even if you do, they come back as zombies, and updates that you can at best delay, but also never stop. And that's on top of all the other privacy invasive "features" that are set by default, and Microsoft makes it hard for 99% of the users to know they can turn them off.

I have a lot of sympathy for Microsoft here, given some professional history with Chrome's Sync feature. Originally Sync data was always encrypted locally with either your Google password or a custom passphrase, and recovery wasn't possible (well, practical) absent that passphrase. The result was a bit of a support nightmare, as people would lose their sync data because they changed their account password and forgot the old one, or upgraded their machine and had forgotten the password years before, because it was being autofilled.

To solve the problem we ended up changing the way we managed the encryption, so we could recover the data for the default case, and kept the custom passphrase as an opt-in for local-only encryption. That's not to say I think we did everything we could to promote and support the use of a custom passphrase, but I am thoroughly convinced that it's not something the majority of users are concerned about or want to hassle with. If the average user forgets their password they still want to be able to get their data back (and there's no good way to forewarn or explain away why it won't work).

User: "What do you mean I can't access my emails because I lost my password?"

Admin: "For privacy, it's designed so that your password is only thing that unlocks the keys. If that's gone, then the email is gone. That's how it's supposed to work."

User: "Well, that's bullshit. Now, we might loose all kinds of money over this crap. And for what!? It's not like there's people snooping our traffic on the internal network."

Scenario plays out in so many situations. In business, it's availability first, integrity second, and confidentiality maybe. Almost always.

This was nobody's fault but your own. FDE has been available for Windows for over a decade. You didn't have to wait for Microsoft to (poorly) implement this.

I think the author of the article meant to compare the Windows behavior with other desktop operating systems, including Microsoft's other desktop operating systems. (I know him and have sometimes talked to him about this topic.)

> Of course, keeping a backup of your recovery key in your Microsoft account is genuinely useful for probably the majority of Windows users, which is why Microsoft designed the encryption scheme, known as “device encryption,” this way. If something goes wrong and your encrypted Windows computer breaks, you’re going to need this recovery key to gain access to any of your files. Microsoft would rather give their customers crippled disk encryption than risk their data.

> “When a device goes into recovery mode, and the user doesn’t have access to the recovery key, the data on the drive will become permanently inaccessible. Based on the possibility of this outcome and a broad survey of customer feedback we chose to automatically backup the user recovery key,” a Microsoft spokesperson told me. “The recovery key requires physical access to the user device and is not useful without it.”

The crux of the matter is that the article is trying to confuse readers of the purpose of the encryption. The purpose of Windows "device encryption" is to keep anyone other than you from using your device or getting data off your drive. If you're worried about Microsoft stealing your files, they don't need your key: they just need to wait for you to log in. The only reason Microsoft has the key by default is because users inevitably forget their password and people would be very, very upset if that meant all their data disappeared, just as the above quoted paragraphs suggest.

And if you're a power user who really knows what you want, then you don't have to let Microsoft have the key to your device.

It sounds like a pretty sane system to me and a non-issue.

> Or a law enforcement or spy agency could send Microsoft a request for all data in your account, which would legally compel them to hand over your recovery key, which they could do even if the first thing you do after setting up your computer is delete it.

> As Green puts it, “Your computer is now only as secure as that database of keys held by Microsoft, which means it may be vulnerable to hackers, foreign governments, and people who can extort Microsoft employees.”

The status quo was that if law enforcement or criminals seized your computer, they by default could access all your files. By encrypting the device by default, they at least added an additional hurdle for law enforcement and made it all but impossible for the common thief.

I don't see much to complain about other than it would be nice if Home users had the full Bitlocker feature.

Most users just beam all their data up to Google. LEO and whoever really wants to can get them to hand it over.

That key then is really only useful for keeping opportunistic snatchers in Starbucks out. For which it will work just fine.

Windows is a different story. You can keep your data from being beamed up. Wanting to keep anyone else out then is a matter of changing the key.

A bit of an apples-oranges scenario.

It's microsoft, so it's big evil being evil for the sake of being evil and you should hate them for being evil.

When did Google start storing Android full disk encryption passphrases? I certainly haven't heard that it does.

I agree with everything else you stated though.

This is compared to e.g. either Linux (LUKS) or OS X where the encrypted DEK is stored on the drive itself (outside of the encrypted volume of course), since neither of them leverage a TPM at the moment.