No Backdoor in Vista

mytrip wrote to mention a C|Net article stating that Vista will not have a security backdoor after all. From the article: "'The suggestion is that we are working with governments to create a back door so that they can always access BitLocker-encrypted data,' Niels Ferguson, a developer and cryptographer at Microsoft, wrote Thursday on a corporate blog. 'Over my dead body,' he wrote in his post titled Back-door nonsense."

Comments

Dear Niels I hate to break it to you but...

[badzilla]

... you won't be in the loop if/when it gets compromised.

A quick look at the "Crypto AG" fiasco makes it plain how very much governments want backdoors. "For decades, the US has routinely intercepted and deciphered top secret encrypted messages of 120 countries." Imagine the power some entity would have if it could peek into any Windows system at will - the temptation must be making their toes curl.

Whether or not there is a top-level agreement with top-level spooks it is still unlikely that local lawmen will be allowed to know about it. So what exactly IS Microsoft planning to do when they inevitably get a request to "help" with an encrypted drive?

Re:Right.

[Haeleth]

I suspect the NSA, (who I seem to recall left a few stray tags lying around in a previous version of Windows' code)

Yes and no.

True, there was a tag in one version of Windows NT 4 that had the name "_NSAKEY". However, it has never been linked to the NSA in any way whatsoever, except by conspiracy theorists.

You might as well claim that USER32.DLL is proof of a conspiracy to turn American back into a British colony (U.S. obviously stands for United States, and E.R. = Elizabeth Regina = the queen of England! OMG BILL GATES HATES AMERICA!)

Here is Bruce Schneier's take on the matter.

Re:... that he knows of.

[dprovine]

There's no reason you couldn't be for Microsoft and also be for some other entity too. The deception would pretending to be for Microsoft alone. But if you work for the NSA, and you get a job at Microsoft, you may well write good code, and fix security holes, and otherwise help them succeed even while ensuring NSA access to things secured using Microsoft products. Very few things in life are completely either/or.

If Microsoft caught you and you got sued, the last thing that would happen is the NSA saying a word. I suspect the following, in decreasing order of probability:

• You make it look like a huge mistake.
• You tell them you wrote your password down and put it in your wallet, and your wallet was lost and later returned, and you didn't think to update the password.
• Some heretofore unknown rich uncle dies and leaves you enough money to cover the lawsuit.
• You die in an auto accident.

In any case, before placing an asset in such a position, the NSA would probably train such a person with the right lies to tell if something goes wrong. If I were going to do something like that, I'd make up a fake history for the person before Microsoft hired him, and if he got caught then the FBI could investigate and tell Microsoft he was actually a spy for the Mossad. It wasn't even his real name or anything! But for sure the NSA would keep their name out of it. There's a reason they're known as the "No Such Agency".