> Any power users who prefer their own key management should follow the steps to enable Bitlocker without uploading keys to a connected Microsoft account.

Except the steps to to that are disable bitlocker, create a local user account (assuming you initially signed in with a Microsoft account because Ms now forces it on you for home editions of windows), delete your existing keys from OneDrive, then re-encrypt using your local account and make sure not to sign into your Microsoft account or link it to Windows again.

A much more sensible default would be to give the user a choice right from the beginning much like how Apple does it. When you go through set up assistant on mac, it doesn't assume you are an idiot and literally asks you up front "Do you want to store your recovery key in iCloud or not?"

> Any power users who prefer their own key management should follow the steps to enable Bitlocker without uploading keys to a connected Microsoft account.

Once the feature exists, it's much easier to use it by accident. A finger slip, a bug in a Windows update, or even a cosmic ray flipping the "do not upload" bit in memory, could all lead to the key being accidentally uploaded. And it's a silent failure: the security properties of the system have changed without any visible indication that it happened.

You can always count on someone coming along and defending the multi-trillion dollar corporation that just so happens to take a screenshot of your screen every few seconds (among many, many - too many other things)

> Journalists love the "Microsoft gave" framing because it makes Microsoft sound like they're handing these out because they like the cops, but that's not how it works. If your company has data that the police want and they can get a warrant, you have no choice but to give it to them.

I’m not sure how you’re criticizing the “gave” framing when you’re describing and stating Microsoft literally giving the keys to the FBI.

> If your company has data that the police want and they can get a warrant, you have no choice but to give it to them.

Yes. The thing is: Microsoft made the design decision to copy the keys to the cloud, in plaintext. And they made this decision with the full knowledge that the cops could ask for the data.

You can encrypt secrets end-to-end - just look at how password managers work - and it means the cops can only subpoena the useless ciphertext. But Microsoft decided not to do that.

I dread to think how their passkeys implementation works.

> Any power users who prefer their own key management should follow the steps to enable Bitlocker without uploading keys to a connected Microsoft account.

The real issue is that you can't be sure that the keys aren't uploaded even if you opt out.

At this point, the only thing that can restore trust in Microsoft is open sourcing Windows.

Power users should stop bothering with Windows nonsense and install Linux instead so that they can actually have control over their system.

It's 2026. The abuses of corporations are well documented. Anyone who still chooses Windows of their own volition is quite literally asking for it and they deserve everything that happens to them.

> Journalists love the "Microsoft gave" framing because it makes Microsoft sound like they're handing these out because they like the cops, but that's not how it works. If your company has data that the police want and they can get a warrant, you have no choice but to give it to them.

Often it is the case that companies hand over private data to law enforcement just by being asked for it nicely, no warrant needed.

I'm not sure how to do this on Windows, but to disable FileVault cloud key backup on Mac, go to `Settings > Users & Groups > click on the (i) tooltip next to your account` and uncheck "Allow user to reset password using Apple Account".

This is a part of Settings that you will never see at a passing glance, so it's easy to forget that you may have it on.

I'd also like to gently push back against the cynicism expressed about having a feature like this. There are more people who benefit from a feature like this than not. They're more likely thinking "I forgot my password and I want to get the pictures of my family back" than fully internalizing the principles and practices of self custody - one of which is that if you lose your keys, you lose everything.

> It protects their data in the event that someone steals the laptop, but still allows them to recover their own data later from the hard drive.

False. If you only put the keys on the Microsoft account, and Microsoft closes your account for whatever reason, you are done.

MacOS has this feature as well. It used to be called "Allow my iCloud account to unlock my disk," but it keeps getting renamed and moved around in new MacOS versions. I think it's now tied together with remote password resets into one option called "allow user to reset password using Apple Account."

> If your company has data that the police want and they can get a warrant, you have no choice but to give it to them.

They can fight the warrant, if you don't at least object to it then "giving the keys away" is not an incorrect characterization.

Exactly. And any halfway decent corporate IT setup would be managing the keys themselves as well (although I would imagine many third party tools could also be compelled to do this with a proper warrant)

Bitlocker on by default (even if Microsoft does have the keys and complies with warrants) is still a hell if a lot better than the old default of no encryption. At least some rando can't steal your laptop, pop out the HDD, and take whatever data they want.

The "reasonable default" is to force the user to actually make the choice, probably after forcing the user to prove they understand the implications.

To be fair, if they didn't have BitLocker enabled at all, the FBI would have just scanned the hard-drive as-is. The only usefulness of BitLocker is if a stranger steals your laptop, assuming Microsoft doesn't hand out the keys to just anybody, your files should be safe, in theory.

It’s definitely better than no encryption at all, which would be what most people would have otherwise.

>Any power users who prefer their own key management should follow the steps to enable Bitlocker without uploading keys to a connected Microsoft account.

I have W11 w a local account and no bitlocker on my desktop computer, but the sheer amount of nonsense MS has been doing these days has really made me question if 'easy modding*' is really enough of a benefit for me to not just nuke it and install linux yet again

* You can get the MO2 mod manager running under linux, but it's a pain, much like you can also supposedly run executable mods (downgraders, engine patches, etc) in the game's context, but again, pain

> Any power users who prefer their own key management should follow the steps to enable Bitlocker without uploading keys to a connected Microsoft account.

You mean "Install Linux",because that's easier than dealing with the steps required to do that on Windows

Hacker News defending corporate key escrow. Wow.

> It protects their data in the event that someone steals the laptop, but still allows them to recover their own data later from the hard drive.

It allows /anyone/ to recover their data later. You don't have to be a "purist" to hate this.

Correct me if I'm wrong, but isn't forcing you to divulge your encryption password compelled speech? So the police can crack my phone but they can't force me to tell them my PIN.

So long as Microsoft also "give customer set of BitLocker encryption keys to unlock their own laptop" in the right set of conditions.

20 requests per year also doesn't sound like a privacy problem. These are people where the police got a search warrant for the hard drives.

I'd be more concerned about access to cloud data (emails, photos, files.)

At Microsoft-scale, data requests from law enforcement are an inevitability. Designing a system such that their requests are answerable is a choice. Signal's cloud backup system is an example of a different choice being made.

The reasonable default is transparency about it and 2FA for recovery scenarios. MS does not have to have the keys in the clear, as it is reasonable for any secrets you store.

That would be all well and good if any of this was communicated to the user.

The problem is they don't make this clear to the user or make it easy to opt out. Contrast with how Apple does it.

If you are super concerned about their privacy, should you be using Windows anyway? Or any commercial OS for that matter?

So you're saying Microsoft gave the FBI the key?

And the only reason windows uploads the keys is that Microsoft wants to help the government while fucking you.

There needs to be more awareness into setting up W11 install ISO's which can be modified to disable bitlocker by default, disable the online account requirement.

I recently needed to make a bootable key and found that Rufus out of the box allows you to modify the installer, game changer.

> This makes the privacy purists angry, but in my opinion it's the reasonable default for the average computer user.

Absolutely not. If my laptop tells me that it is encrypted by default, I don't like that the default is to also hold a copy of the keys in case big brother wants them.

Call me a "privacy purist" all you want, but it shouldn't be normal to expect the government to have access to a key to your house.

Microsoft could have done key backups to secure enclaves that will only return them to a user able to produce valid signatures using a backup code or otherwise they hold. Hell they were the ones that normalized remote attestation.

But Microsoft chose to keep them plain text, and thus they are, and will continue to be abused.

We must not victim blame. This is absolutely corruption on microsofts part.

It would make me a lot less angry if Microsoft didn't go out of their way to force people to use a Microsoft account of course.

The same is true for Apple laptops! Take a look in your Passwords app and you will see it automatically saves and syncs your laptop decryption key into the cloud.

So all the state needs to get into your laptop is to get access from Apple to your iCloud account.

This is a really bad take

The choice is not between honoring the warrant and breaking the law.

They can go to a judge and fight the warrant. Other companies have done this.

Microsoft won’t, one more reason I will never use anything from them.

I think this is a fair position and believe you're making it in good faith, but I can't help but disagree.

I think the reasonable default here would be to not upload to MS severs without explicit consent about what that means in practise. I suspect if you actually asked the average person if they're okay with MS having access to all of the data on their device (including browser history, emails, photos) they'd probably say no if they could.

Maybe I'm wrong though... I admit I have a bad theory of mind when it comes to this stuff because I struggle to understand why people don't value privacy more.

>can compel Microsoft to provide the keys

can they compel testimony? keys, passcodes and the like are usually considered testimony. did they try? the usual story here is that they don't have to, that the big corporations will turn over any info they have on request because they can and the government makes a better friend than a single user. the article mentions 20 "requests" per year on average but doesn't say anything about the government using force.

I agree with your conclusion though: data you share with anyone is data you've shared with everyone and that includes your encryption keys. if that matters to you, then you need to take active steps to ensure your own security because compelled or not, the cloud providers aren't here to help keep you safe.

Similar case with Apple devices. They default to backing up to Apple servers where they are unencrypted. So they can provide data to police if requested. But for anyone concerned about privacy they can use Advanced Data Protection which encrypts all their data and prevents Apple from reading it or recovering it.

Definitely agree that choices like these are the most sane for the default user experience and that having these advanced options for power users to do with it what they want is a fair compromise. Wish more people were open to designing software for the average person and compromising on a middle ground the benefits both kinds of users.

Any power users should avoid Windows entirely.

This is a great reminder: if your device doesn't ask you for a pin/passphrase every time it turns on, it's not actually encrypted.

> Journalists love the "Microsoft gave" framing because it makes Microsoft sound like they're handing these out because they like the cops, but that's not how it works. If your company has data that the police want and they can get a warrant, you have no choice but to give it to them.

These two statements are in no way mutually exclusive. Microsoft is gobbling up your supposedly private encryption keys because they love cops and want an excuse to give your supposedly private data to cops.

Microsoft could simply not collect your keys and then would have no reason or excuse to hand them to cops.

Microsoft chose to do this.

Do not be charitable to fascists.

Doesn’t windows 11 force you to use a Microsoft account

> you have no choice but to give it to them

Will they shoot me in head?

What if I truly forgot the password to my encrypted drive? Will they also shoot me in the head?

Yeah guys, if it's encrypted by default, it's not a violation of user security or privacy expectations to have a set of master keys that you hold onto and give to third parties to decrypt user devices. I mean it was just encrypted by default... by default...

VeraCrypt exists for this reason or other open source programs. Why would you ever trust encryption to closed source?

Also, this essay by Mickens at USENIX over a decade ago - https://www.usenix.org/system/files/1401_08-12_mickens.pdf

Tl;dr - "Basically, you’re either dealing with Mossad or not-Mossad. If your adversary is not-Mossad, then you’ll probably be fine if you pick a good password and don’t respond to emails from ChEaPestPAiNPi11s@ virus-basket.biz.ru. If your adversary is the Mossad, YOU’RE GONNA DIE AND THERE’S NOTHING THAT YOU CAN DO ABOUT IT" (Mickens, 2014)

None of this matters. XKCD. Hit him with this $5 wrench until he gives you the keys.

> you have no choice but to give it to them

There is always a choice.

user notification is another major litmus test.

>The defaults will also upload the BitLocker key to a Microsoft Account if available.

>This is why the FBI can compel Microsoft to provide the keys.

>in my opinion it's the reasonable default

I really can't imagine what kind of person would say that with a straight face. Hanlon's razor be damned, I have to ask: are you a Microsoft employee or investor?

> Back in the day hackernews had some fire and resistance.

Most of the comments are fire and resistance, but they commonly take ragebait and run with the assumptions built-in to clickbait headlines.

> Too many tech workers decided to rollover for the government and that's why we are in this mess now.

I take it you've never worked at a company when law enforcement comes knocking for data?

The internet tough guy fantasy where you boldly refuse to provide the data doesn't last very long when you realize that it just means you're going to be crushed by the law and they're getting the data anyway.

> Too many tech workers decided to rollover for the government and that's why we are in this mess now.

It has nothing to do with the state and has to do with getting the RSUs to pay the down payment for a house in a HCOL area in order to maybe have children before 40 and make the KPIs so you don't get stack-ranked into the bottom 30% and fired at big tech, or grinding 996 to make your investors richest and you rich-ish in the process if you're unlikely enough to exit in the upper decile with your idea. This doesn't include the contingent of people who fundamentally believe in the state, too.

Most people are activists only to the point of where it begins to impede on their comfort.

> This isn't an argument about law, it's about designing secure systems

False. You can design truly end-to-end encrypted secure system and then the state comes at you and says that this is not allowed, period. [1]

[1] https://medium.com/@tahirbalarabe2/the-encryption-dilemma-wh...

yeah, every time someone says 'good, government must protect us from terrorists', they need to remember that sometimes

  govt := new_govt
  terrorist := you

> Too many tech workers decided to rollover for the government

s/workers/Corporations/

I don’t see that at all. Instead, I think tech workers, including the engineers and the product managers, are correctly prioritizing user convenience over resistance to government abuse. It’s honestly the right trade off to make. Most users worry about casual criminals, not governments. Say a criminal snatching your laptop and accessing your files that way. If you worry about governments you should already know what to do.

The resistance is to switch to Linux.

it the natural results this site catter not just to tech nerds but one chasing venture capital money. its an inudustry that has never seen a dark patern it didn't like. we have gone from "don't be evil" to "be evil if makes the stonks go up"

I actually understood that as in “of course . . . because Microsoft”

I used to be a principled freedom fighter. But others defected(thinking mostly about Apple users...). I promoted open source software, even dealing with the pains.

So now I just use whatever I want. Someone else can be a tech moralist.

And too many tech workers decided to rollover for the big companies too. Accepting and advocating whatever they do. Even when it is tricky, can find the way to defend the big names, because they are big names, they know the way, they became big!

Unfortunately there's a loud contingent of incredibly proud idiots that post here as well that really like to pretend they know what they're doing.

The people going 'well of course' or 'this is for the user' drive me insane here because as said, there are secure ways you can build a key escrow system so that your data and systems are actually secure. From a secure design standpoint it feels more and more like we're living in Idiocracy as people argue insecure solutions are secure actually and perfectly acceptable.

It’s not about engineers being lazy, it’s about money.

Trying to resist building ethically questionable software usually means quitting or being fired from a job.

Saying "of course" doesn't mean we agree with it or fail to try to resist it. It's simply not surprising that this happened.

When you get high up in an org, choosing Microsoft is the equivalent of the old "nobody ever got fired for buying IBM". You are off-loading responsibility. If you ever get high up at a fortune 500 company, good luck trying to get off of behemoths like Microsoft.

This is such a lazy take and ignores that this is the only system that has the property of not losing data when users forget their passwords and lose (or likely never write down) their recovery key.

That's it. That's the whole thing. Whatever "secure system" you build will not have this property and users will lose their data, be mad at you, and eventually you'll have to turn it off by default leaving everyone's data in plaintext. It's a compromise that improves security for people who previously left their disk unencrypted. It changes nothing for people who previously did their own key management.

You won't be able to turn the first group into the second group. That's HN's "Average Familiarity" fallacy. The fact that basically every 2FA system has a means of recovering your account by removing it should tell you that even technical people are shit at key management.

It's why tech loves young engineers who just do what their told, of old engineers only as long as they can't say no. Once you dig into the system and see how all the pieces fit together, you can't ethically or morally continue to participate any longer. Learned that the hard way. In the middle of an attempt at midlife career change because of it to maybe free myself to write software that needs to be written instead of having to have a retained lawyer on hand to wrangle employment contract clauses to keep my work belonging to me.

> Too many tech workers decided to rollover for the government and that's why we are in this mess now.

It isn't really about the government. It's about a bunch of people trying to convince you that the locked-down proprietary closed source corporate crap that they use isn't in and of itself a security risk, no matter what the quality of the code that you've never seen is. Apple, Microsoft, Google etc. aren't your friends; no matter how brand loyal you are, they'll never care whether you're alive or dead.

FOSS isn't your friend either, but they're not asking you to trust them. Any exposure to these world spanning juggernaut military and intelligence contractor companies is a security hole. It's insane that people (thinking of Europeans now) get fired up to switch from this stuff because Trump but not because of course you should. Instead they're busy calling being suspicious of Microsoft old and hatred of Apple's customer corral stuck up and the desire to own your own machine fanatical and judgemental. Have you ever considered that you've been programmed to say and encourage dumb stuff that is completely against your own interests and supports the interests of the people who sell things to you?

You're convinced by the argument that people dumber than you have to be protected from their own machines (by corporations who have no interest in or obligation to protect them) - have you ever thought that people are saying the same thing about you? That you have to be protected from writing things you shouldn't write or talking to people you shouldn't be talking to? And the world isn't a meritocracy: the people on the top are inbred creeps. You've given up your freedom to dummies with marketing departments.

The median user's threat model doesn't include the government, but does include data loss, forgetting the password, or a thief stealing your laptop. Microsoft struck the right balance.

I'm glad the knee-jerk absolutists are marginal, for one. A world run by you people would be much worse for anyone who isn't you.

> What happens if I forget my keys? … restore contents from backups.

What happens if you forget your backup keys?

It's a good start, but FDE alone is still fairly easy to compromise in many cases. If you ever type the password under a camera, it may be leaked. If the device ever leaves your possession and you don't have secure boot, your bootloader can be trivially altered to leak the password. Then there are keyloggers. And cold boot attacks can often be done if your system is running.

Yeah, if the drive can be encrypted by an external party that you didn't give permission, I'm not sure how it's really "encryption" other than burning cycles when doing writes.

Obligatory XKCD https://xkcd.com/538

I wish there was more people like you and me.

Privacy is not a crime.

I've been trying to get my parents to move, but until Microsoft Office desktop is able to be run natively on there my parents won't entertain the subject.

I've tried to get them to use the web version of office, I've tried to get them to use OnlyOffice and LibreOffice, I've even tried showing them LaTeX as a last ditch effort, but no, if it isn't true Microsoft Branded Office 2024, the topic isn't even worth discussing [1].

I'm sure there are technical reasons why Wine can't run Office 2024, and I am certainly not trying to criticize the wine developers at all, but until I can show Wine running full-fat MS Office, my parents will always "miss" Windows.

To be clear, I hate MS Office. I do not miss it on Linux. I'm pretty sure my parents could get by just fine with LibreOffice or OnlyOffice or Google Docs, but they won't hear it.

I've also tried to get them to use macOS, since that does have a full-fat MS Office, I've even offered to buy them Macbooks so they can't claim it's "too expensive", and they still won't hear it. I love my parents but they can be stubborn.

[1] Before you accuse me of pushing for "developer UI", LaTeX was not something I led with. I tried the more "normy-friendly" options first.

Just remember, never use or recommend Debian-family(Ubuntu/Mint) or you will be back to windows. Do not fall for the marketing term Stable, which means outdated and contains bugs that are fixed.

Fedora is my recommendation. I remind people Fedora is not Arch. Fedora is a consumer grade OS that is so good, I don't lump it in with the word Linux.

It's not like companies have a choice. If they have a key in their possession and law enforcement gets an order for it, they have to provide it.

All other governments is a stretch here, but likelihood of at least one another government getting same privileges is extremely high.

Why take the drastic step of switching to linux (a difficult endeavor) when you can simply turn off key uploading.

It's certainly a reasonable default. People lose or have their laptops stolen much more often than they get targeted by their governments.

Though that doesn't mean Microsoft couldn't implement a way of storing these keys so that they can't be accessed by Microsoft. Still better than nothing though.

I'll always remember - when I was first learning about it, one of the interesting counter-arguments to ignoring privacy was "what if the Nazis come back, would you want them to have your data?". I suppose there's some debate these days, but hostile governments seem a lot closer than they were 10-15 years ago.

Will this make people care? Probably not, but you never know.

In Apple's case, starting with macOS Tahoe, Filevault saves your recovery key to your iCloud Keychain [0]. iCloud Keychain is end-to-end encrypted, and so Apple doesn't have access to the key.

As a US company, it's certainly true that given a court order Apple would have to provide these keys to law enforcement. That's why getting the architecture right is so important. Also check out iCloud Advanced Data Protection for similar protections over the rest of your iCloud data.

[0] https://sixcolors.com/post/2025/09/filevault-on-macos-tahoe-...

You shouldn't include Apple in this.

As of macOS Tahoe, the FileVault key you (optionally) escrow with Apple is stored in the iCloud Keychain, which is cryptographically secured by HSM-backed, rate-limited protections.

You can (and should) watch https://www.youtube.com/watch?v=BLGFriOKz6U&t=1993s for all the details about how iCloud is protected.

> Don't think Apple wouldn't do the same.

Of course Apple offers a similar feature. I know lots of people here are going to argue you should never share the key with a third party, but if Apple and Microsoft didn't offer key escrow they would be inundated with requests from ordinary users to unlock computers they have lost the key for. The average user does not understand the security model and is rarely going to store a recovery key at all, let alone safely.

> https://support.apple.com/en-om/guide/mac-help/mh35881/mac

Apple will escrow the key to allow decryption of the drive with your iCloud account if you want, much like Microsoft will optionally escrow your BitLocker drive encryption key with the equivalent Microsoft account feature. If I recall correctly it's the default option for FileVault on a new Mac too.

> Don't think Apple wouldn't do the same.

Except for that time they didn't.

https://www.apple.com/customer-letter/

It is the default setting on windows 11 to share your key with microsoft.

I was going to say: "Well Apple historically is an easy target of Pegasus" but that can only be used a few times before Apple figures out the exploit and fixes it. Its more expensive than just asking the Apple.

But given PRISM, I'm sure Apple will just give it up.

Both Microsoft and Apple (I think Apple does) have the option to encrypt those keys with the user's password where they are storing them.

Just use open source encryption

Remember when the original dev of TrueCrypt (the VeraCrypt predecessor) suddenly abandoned the project and wrote that people should use BitLocker instead? [1] [2]

We now know that BitLocker is not secure, and an intelligent open source dev saying that was probably knowingly not saying the truth.

The best explanation to me is that this was said under duress, because somebody wanted people to move away from the good TrueCrypt to something they could break.

[1] https://truecrypt.sourceforge.net

[2] https://en.wikipedia.org/wiki/TrueCrypt#End_of_life_announce...

Sadly VeraCrypt is not optimized for SSDs and has a massive performance impact compared to Bitlocker for full disk encryption because the SSD doesn't know what space is used/free with VeraCrypt.

Agree, use Linux, use LUKS.

PGP WDE was a preferred corporate solution, but now you have to trust Broadcom.

Keys are stored securely in a TPM in the sense that a random program has no access to it. They are not stored safely there in the sense that they couldn’t possibly get destroyed. TPM hardware, or the motherboard that hosts it, occasionally fails. Or you might want to migrate your physical hard drive to a different PC. That’s the purpose of backing up the keys to the cloud. Alternatively, you can write down a recovery key and put it in your safe. Personally, I put it in my password vault that also happens to be backed up to the cloud (though not Microsoft’s).

except MS could easily turn something on without you knowing and be uploading your files to their cloud. Yes, I believe they would stoop that low and even lower.

or not use microsoft products for encryption

No, and by default the keys are stored on the disk so it's not actually secure.

If you open the BitLocker control panel applet your drive(s) will be labelled as "Bitlocker waiting for activation".

> Yes, but Which version/fork?

If I earn my living from a company that doesn't make Linux versions, should i still switch?

Should my customers?

It's a great idea, and my work does not touch the internet, but the confusing variations of linux do not a happy workfoce make.

Your 'lord and saviour' can fuck off, with all the others, I prefer science.

What quid pro quo? Is there an allegation that the FBI gave Microsoft something in exchange?

As far as I can see this particular case is a straightforward search warrant. A court absolutely has the power to compel Microsoft to hand over the keys.

The bigger question is why Microsoft has the recovery feature at all. But honestly I believe Microsoft cares so little about privacy and security that they would do it just to end the "help customers who lose their key" support tickets, with no shady government deal required. I'd want to see something more than speculation to convince me otherwise.

Water is not wet. Water makes non-hydrophobic materials wet.

This news piece from a non-tech organization will help educate non-tech people.

> Not a reason to violate privacy IMO, especially when at the time this was done these people were only suspected of fraud, not convicted.

Well you can't really wait until the conviction to collect evidence in a criminal trial.

There are several stages that law enforcement must go through to get a warrant like this. The police didn't literally phone up Microsoft and ask for the keys to someone's laptop on a hunch. They had to have already confiscated the laptop, which means they had to have collected enough early evidence to prove suspicion and get a judge to sign off and so on.

They had a warrant. That's enough. Nobody at Microsoft is going to be willing to go to jail for contempt to protect fraudsters grifting off of the public taxpayer. Would you?