Exposing? Microsoft has made it very clear for a while that your Bitlocker keys are synced to your Microsoft account.

Hell, they even have a support page for it. Most of their support pages are nearly useless, but this one is even readable by a normal person.

And before someone mentions the part about Microsoft Support not having access to keys (because some smart ass always does for this stuff)... Just think for a second. Of course customer support doesn't have access to the keys. What Support can do is not a limit for legal disclosure. A legal warrant (like used here) means they'll give any info they have in a heartbeat.

It’s not a security flaw, it’s by design. Microsoft has been building this surveillance apparatus for years, and the purchase of government access to your computer and data using your tax dollars is a lucrative alignment of state and corporate power. Their recent design choices point to a rabid desperation to turn your PC into an Apple-style walled-garden.

It goes like this:

• Require online Microsoft account creation.

• Require TPM compliance to run Windows.

• Forcibly encrypt the user’s data under the guise of “security”, even without permission or even user action. (Encryption is good! Right?)

• Link your identity, payment information, data, online activity, and encryption keys to your hardware ID.

• Record everything you do and use that data to train an AI model with onboard tensor hardware.

• Exfiltrate the entire model, or just query it remotely for “online services.” Or, in this case, just have MS give you the fucking recovery keys. lol

All done “securely” with tamper resistance and mathematical verifiability that whatever is on your device is yours, and that you took that action with limited plausible deniability.

If you think you’ve got nothing to hide, think again about the current activities of ICE, law enforcement investigations based on reproductive health data, the pornography suppression movement, age verification, and the data harvesting of dissenting speech. What’s legal today can quickly become “illegal” tomorrow. The constitution is just a piece of paper in a fancy climate controlled box.

Why can't just one of our companies not be blood-sucking assholes?

If they're selling bitlocker as "full-disk encryption", doesn't that open them up to a class action since encryption with a backdoor isn't encryption?

On Linux, selecting LUKS when you install encrypts the disk without the potential for this problem. So far it's proven to be very reliable at stopping state level actors, just don't use a password that you use elsewhere

Oh no, who could have possibly seen this coming when Microsoft decided to back up your full-disk encryption key automatically to OneDrive.

Smart of them to deploy automatic full disk encryption just as open source projects like Trucrypt and Veracrypt were starting to become mainstream, capturing their market share (Netscape Navigator-style). Very incompetent of them to include many glaring backdoors that completely defeats the encryption that they offer.

In addition to being vulnerable to law enforcement through subpoenas on the stored key. Anytime you run a Windows update and the system has to reboot, it writes a 'clear key' to the hard drive which can be easily retrieved if the disk is stolen and also they bypass TPM Validation.

You know, the thing that is so important to have that you were forced to buy an entirely new computer... it is not active during a system update and anybody who had access to your hard drive can write arbitrary code into your system files.

Well, you would think that this isn't very useful, after all they would have to have pretty good timing to catch you updating your computer to remove the hard drive, right?

Nope, if they steal your whole computer and plug it into power and a network connection, the next time a Windows update hits the system will automatically apply the update (absent a very specific Group Policy) and write the full-disk encryption key to the hard drive before shutting down.

I'm no expert computerologist, but I think that any system that requires anybody but you to have your key is insecure. If this is the kind of poor design choices that they make in regards to disk encryption then I would personally have no confidence that their proprietary code is not equally porous.

2026 linux

LINUX.

I'm not surprised. The standard Microsoft disclosure on my work laptop at the login screen states any use ofbthw computer may be monitored and/ or recovered by Microsoft and law enforcement. That's why Microsoft products are not present in my home.

“Flaw”

If you really were still naive enough to think that a public tech company cares about your right to privacy at that point, it's pretty much on you.

who would use that for illegal stuff? prison is full of them.

Didn’t this happen with an iPhone a few years back? FBI couldn’t get into a suspect’s phone, Apple stood firm publicly, but then somehow the FBI got in anyway? Maybe I’m misremembering.

Regarding this as a flaw is a bit thin right? Massive breach of trust and huge legal issues.

Don't store your secrets on the cloud.

EVER.