Technology

To use Windows without a Microsoft account requires tech literacy these days, I thought. I would not be suprised if users didn't choose to sync with a MS account but it's doing it anyway, if that's what MS want.

Encryption doesn't actually complete until you log in with a Microsoft account for Home Edition.

Anyways: Use Veracrypt.

Or just Linux + LUKS

It's a bit harsh and unfair to say "you are dumb enough to allow it". Microsoft makes it damn near impossible to avoid this unless you are extremely particular and savvy about it, and never have an off day where you make a mistake while using your PC.

Don't use ~~a Microsoft account with~~ Windows

Ftfy

But, by default, BitLocker recovery keys are uploaded to Microsoft’s cloud, allowing the tech giant — and by extension law enforcement — to access them and use them to decrypt drives encrypted with BitLocker, as with the case reported by Forbes.

I mean it's dumb to sync but at same time it's not like MS isn't great at either making it almost impossible to not sync it re-enable syncing for a bit after updates.

You can constantly tell it not to sync but all it takes is MS saying we want it now and they'll get it

Save a copy of your bitlocker keys to a Veracrypt drive with a password no shorter then 15 mixed characters. Then upload that encrypted container to any free service. They wont be able to open it and now you have a remote backup copy.

They do have a copy of your Bitlocker key if you are dumb enough to allow it to sync with your Microsoft account, you know, “for convenience.”

Which I don't believe is the only way it can leak. It's well known Microsoft can access anything and everything on an internet connected Windows PC whether there's a Microsoft account or not. If the nazi's push for the device of someone on a local account only, you know they'll magically find a way.

Are you naive enough to believe the surveillance OS that uploads literally all of your activity along with screenshots of your desktop doesn't automatically upload you keys no matter what little box you tick on the installer?? 😂 there is absolutely not one single 3rd party auditing that they actually follow any of the options at all that they give.

Why is that dumb?

I encrypt my drive to protect my data from burglars and thieves who might steal my laptop, how would they obtain the recovery key from Microsoft? O_o

Except that Microsoft basically puts a gun to every users head to login with a Microsoft account which can/does backup the recovery keys.

If you sign into a Microsoft account during setup, Microsoft automatically turns on bitlocker and sends the key off to Microsoft for safe keeping. You are right, there are other ways to handle bitlocker, but that's way beyond most people, and I don't think Microsoft even tells you this during setup. It's honestly a lifesaver for when bitlocker breaks(and it does), but it comes at a cost. In the business world, this is seen as a huge benefit, as we aren't trying to protect from the US government, mostly petty theft and maybe some corporate espionage.

As is often the case, the real solution is Linux, but that, too, is far beyond most people until manufacturers start shipping Linux machines to big box stores and even then they'd probably not enable any encryption.

As long as you're doing your own whole disk encryption, you have a valid path to still be secure. However, if you're running an unencrypted disk, you're much more likely to lose your data to a non-state actor.

Well this isn't directly related to those, so maybe some derision is warranted.

Both are completely unrelated to the discussion. TPM sometimes have issues regarding their security, but you can certainly use Secure Boot with your own signing keys to ensure the kernel you run is one you installed, which improves security. And you can use TPM to either keep your FDE keys, or only part of them combined with a PIN if you don't fully trust them to be secure, so you keep strong encryption but with a bit of convenience.

Without a (properly configured) Secure Boot startup, anyone could just put a malware between the actual boot and your first kernel. If the first thing that happens when you boot is something asking for a password to be able to decrypt your storage, then an attacker can just put something here, grab your password, and let you proceed while storing in a a place it can be retrieved.

Is this scenario a concern for most people? That's unlikely. But every computer sold these last five years (at least!) can be setup to reduce this risk, so why not take advantage of it.

You're assuming there isn't a master pubkey baked into the software.