Hacker News Reader

Comment by EvanAnderson | Hacker News Reader

> Does tying those keys to your MS account fix that failure method?

Yes. Bitlocker recovery keys are escrowed to the Microsoft account. I've relied on this recover data from a family member's PC when it failed and they had unknowingly opted-in to Bitlocker (a Microsoft Surface Laptop running Windows 10 S Mode).

View on HN

>> Does tying those keys to your MS account fix that failure method? >Yes. Bitlocker recovery keys are escrowed to the Microsoft account.

Which then opens the door to other attack vectors, even government.

As opposed to just not encrypting their data at all and letting everyone who ends up with the drive have their data.

So one scenario, everyone can access the data if they get the drive. The other, the government might get Microsoft to release the encryption keys.

>As opposed to just not encrypting their data at all and letting everyone who ends up with the drive have their data.

You are presenting a false dilemma where either Bitlocker is in use or the drive is entirely unencrypted; there are other ways to ensure data integrity in the face of physical compromise.

1. It's not a false dilemma, it's more of a question of how to handle the "average Joe" user that doesn't know how to store encryption keys. I don't like how this automatic encryption is implemented, by the way, but sending the keys to MS servers is not the worst idea ever.

2. Bitlocker can totally be used without a MS account and without sending keys anywhere and without TPM... But seeing how most people fail to RTFM we're back to point 1.

I’d imagine most people would like some insurance in the event of loss or theft, but are not worried about government.

I’m vulnerable to the $8 wrench attack, but enjoy knowing it is only a VISA problem if I leave it a laptop the bus.

I mention that only because it's one avenue. I figured obviously on a place like Hacker News that malicious agents aside from government could also compromise the security of 3rd party-held keys; as always security is a matter of difficult tradeoffs and anticipated threat categories.

I'm genuinely curious to know how VISA helps (or doesn't) in your analogy - what is a 'VISA problem'?

Mostly a joke, but I swipe a card and the problem goes away. No need to worry anymore.

Ah, thank you; I get it now: you don't need to worry about data theft because the drive was encrypted, so the only remaining problem is buying a replacement - a 'VISA' problem. I rather like that way of putting it; I might use it myself :)

VISA as in the credit card not a travel permit

Reply on news.ycombinator.com