Do not store your Bitlocker encryption keys on Microsoft's servers if your threat model includes governments or law enforcement. As this article points out, this is the result of a design choice Microsoft made. It didn't have to be this way.

forbes.com/sites/thomasbrewste…

in reply to GhostOnTheHalfShell

@GhostOnTheHalfShell Whsat, I've been talking to myself for the last quarter century? (The answer is yes, it's always been yes. ... "Yes Elf, you're a grumpy old man shaking his fist ineffectually at Redmond (or in that shithole when I lived there) and none of us are listening to you ... even though there's overwhelming evidence you are correct, we just don't care. Now, what was my license key?"

I gave up years ago. Wanna shoot yourself with MS products? Go Ahead! No skin off my teeth.

GhostOnTheHalfShell reshared this.

in reply to evacide

In principle that would also include anyone who knows my email address and can set up a phishing website, right?

Government agencies need whatever a valid warrant is in their jurisdiction, but a user just has to log in to their account and click through the "I forget my Bitlocker password" workflow.

So someone who knows me, or stole my laptop bag with my business cards in it, knows who to phish to get into an account likely to have my recovery key, right?

This entry was edited (1 day ago)
in reply to evacide

Does MS automatically store BitLocker recovery keys on MS accounts for Pro/Enterprise editions of Windows when enabling BitLocker? I know they do this on Home editions of Windows if you have the "Device encryption" feature enabled, but at least for other editions it usually gives you the option to store the recovery key as a file when you enable BitLocker. Unless of course that's not an option that's provided if you deployed a Bitlocker management configuration to a number of devices?
in reply to evacide

The person at Forbes who described this as a 'flaw' seems like they are deliberately underselling it. At least with tech 'flaw' almost entirely implies 'error' rather than 'decision'. It's a little harsher than some of the euphemisms that vendors prefer for product defects, in order to try to normalize how many they ship; but it's absolutely exonerative of one's intentions; which is wholly undeserved.
in reply to evacide

“#Microsoft says it will provide encryption keys for Windows PC data protected by BitLocker where it has access to them and it's received a valid warrant.”

The word “valid” sure is doing a lot of work there. This is the most corrupt DoJ and FBI in generations. One that ignores court rulings that it disagrees with. So what way is the warrant “valid”? Syntactically? Grammatically? Because if we get any deeper, like morally or ethically, the argument gets harder to make.