Microsoft Has Your Encryption Key If You Use Windows 10 (theintercept.com)

← Back to Stories (view on slashdot.org)

Microsoft Has Your Encryption Key If You Use Windows 10 (theintercept.com)

Posted by samzenpus on Tuesday December 29, 2015 @01:13AM from the protect-ya-neck dept.

An anonymous reader writes with this bit of news from the Intercept. If you login to Windows 10 using your Microsoft account, your computer automatically uploads a copy of your recovery key to a Microsoft servers. From the article: "The fact that new Windows devices require users to backup their recovery key on Microsoft's servers is remarkably similar to a key escrow system, but with an important difference. Users can choose to delete recovery keys from their Microsoft accounts – something that people never had the option to do with the Clipper chip system. But they can only delete it after they've already uploaded it to the cloud.....As soon as your recovery key leaves your computer, you have no way of knowing its fate. A hacker could have already hacked your Microsoft account and can make a copy of your recovery key before you have time to delete it. Or Microsoft itself could get hacked, or could have hired a rogue employee with access to user data. Or a law enforcement or spy agency could send Microsoft a request for all data in your account, which would legally compel them to hand over your recovery key, which they could do even if the first thing you do after setting up your computer is delete it. As Matthew Green, professor of cryptography at Johns Hopkins University puts it, 'Your computer is now only as secure as that database of keys held by Microsoft, which means it may be vulnerable to hackers, foreign governments, and people who can extort Microsoft employees.'"

314 comments

Min score:

Reason:

Sort:

Can a corporate security officer comment by RichMan · 2015-12-29 01:16 · Score: 5, Interesting

I would like to know the opinion of large public corporations security officer on this feature of windows.
1. Re:Can a corporate security officer comment by Anonymous Coward · 2015-12-29 01:20 · Score: 3, Informative
  
  I know the opinion of a couple of high security smaller companies, only 20,000 to 60,000 employees... they both say, "holy shit no. Windows 10 is not even being considered for corporate deployment"
  speaking anon to not get in trouble with them.
2. Re:Can a corporate security officer comment by Anonymous Coward · 2015-12-29 01:29 · Score: 2, Insightful
  
  Large public corporations are going to be logging in using Active Directory credentials, not their Microsoft accounts. The article summary (which may be wrong, because they usually are) states that this behavior only happens when logging in with a Microsoft account.
3. Re:Can a corporate security officer comment by Anonymous Coward · 2015-12-29 01:31 · Score: 5, Interesting
  
  CISO here, we haven't made the jump to 10 yet (85% of our workforce is on 7 with some 8.1 here and there), things like this are kinda non starters for us for any employee who even remotely has a chance at accessing PII or confidential information. It's not that I think Microsoft would act maliciously, but it would violate a ton of compliance documentation that we have, requiring re-audits of our policies and procedures. Hopefully this is one of those features Microsoft will allow you to turn off in the Enterprise SKU. We're honestly watching Windows 10 very closely, it has a lot of really nice improvements on the security front. But things like this, and the giant sweeping updates like the November update, make it very hard. Microsoft is trying to move closer to the Apple model, but the Apple model is a big departure for anyone who knows the pains of PCI, HIPAA, or SOC2 compliance.
4. Re:Can a corporate security officer comment by JeffSh · 2015-12-29 01:35 · Score: 5, Insightful
  
  that is a totally out of context comment from an anonymous poster.
  large corporate entities will not deploy windows 10 for years anyway due to incompatible or uncertified line of business software platforms. it has nothing to do with this particular feature.
  moreover, this has to do with logging into your microsoft.com account, nothing to do with windows 10 pro joined to a domain.
5. Re: Can a corporate security officer comment by Billly+Gates · 2015-12-29 01:41 · Score: 1
  
  Windows 10 enterprise doesn't have spyware. Only the home and professional versions do so the point is mute. Great way too to enforce companies buy an expensive corporate blanket and not save with the pro version
  
  --
  http://saveie6.com/
6. Re:Can a corporate security officer comment by Anonymous Coward · 2015-12-29 01:41 · Score: 1, Funny
  
  You're posting anonymously because you're a liar trying to make a point, without losing precious karma off his main account in the process.
  So it's this version of Windows that your non-existent companies finally decided they weren't going to "consider for corporate deployment," eh? What _are_ they deploying corporately, then, seeing as how we're speaking off the record and all? If they're not going with the industry standard, what are they going with? Surely such insider knowledge would be of immense use to everyone trying to secure their systems, not just a karma whore like you.
7. Re:Can a corporate security officer comment by silas_moeckel · 2015-12-29 01:44 · Score: 1
  
  Things like this do not affect the corp version at all. It's specific to people using MS not corp AD servers. We have had key escrow as an optional part of AD for a long time at least in relation to drive/file encryption.
  
  --
  No sir I dont like it.
8. Re: Can a corporate security officer comment by Anonymous Coward · 2015-12-29 01:45 · Score: 2, Informative
  
  The point is moot not mute.
9. Re:Can a corporate security officer comment by Anonymous Coward · 2015-12-29 01:48 · Score: 0
  
  As long as they can blame Microsoft if it all goes tits up, they don't care.
10. Re:Can a corporate security officer comment by Anonymous Coward · 2015-12-29 01:52 · Score: 1
  
  We're moving to TempleOS, not that it's any of your business.
11. Re:Can a corporate security officer comment by Anonymous+Brave+Guy · 2015-12-29 01:54 · Score: 5, Insightful
  
  It's certainly possible that you're right, but equally if the GP poster really does have insider knowledge and really does want to speak without betraying a confidence then surely they really would post anonymously.
  In any case, I can tell you the answer to your follow-up questions for at least some small to medium-sized companies I work with: Windows 10's biggest competition is probably Windows 7, which is what the majority of these organisations are already running as their standard desktop.
  The difficulty Microsoft has with these customers is that Windows 10 doesn't have a lot of big selling points. I watched and listened to some of the early promotional material, and the loudest message I heard was "it's not Windows 8". Obviously to business customers who standardised on Windows 7 anyway, that's not exactly a good reason to undertake an inevitably expensive and disruptive migration to a new OS.
  
  --
  If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
12. Re:Can a corporate security officer comment by Opportunist · 2015-12-29 01:56 · Score: 1
  
  Win10 is not even on the table. Far from it. And as long as there is support for Windows 8, it will not become an issue.
  Seriously, most companies I deal with still use Win7. And they will do so until the final moment of its support.
  
  --
  We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
13. Re:Can a corporate security officer comment by armanox · 2015-12-29 02:00 · Score: 1
  
  Actually, considering the way the industry has been going the past several versions of Windows, is this very surprising? XP still persists in a lot of organizations (sadly). Most places didn't deploy Vista, they waited until 7. And most places are still on 7, out of dissatisfaction with later releases (which also makes Windows 7 the standard, not Windows 10)
  
  --
  I'm starting to think GNU is the problem with "GNU/Linux" these days.
14. Re:Can a corporate security officer comment by Anonymous Coward · 2015-12-29 02:04 · Score: 1
  
  TL;DR: It's horrible, but there are few options.
  Microsoft makes the best development tools around and hence garners the most developers - making business software cheap on the labor side in exchange for higher software costs (ultimately the software costs are tiny compared to the burden of finding and keeping good labor.) The move to get everyone on Windows 10 is a move toward the cloud, this can be seen in all their product lines. Once people are on the cloud they can see what people are doing and start rolling out generic products to grab market share horizontally. In the meantime they will continue raising the costs of in-house software (moving up the end-of-life date for non-cloud products, changing licensing to be per-core-processing-power as opposed to per-machine, per-user or even per-core) and making it cheaper to work in the cloud.
  The code.org/summer-of-code and similar fits of nonsense failed because there are only so many people that can write software competently, that makes the cost of labor very high compared to other fields. They want to reduce the number of programmers required to complete a task because then competition will drive salaries down and save money. The end-game appears to be a monopoly on all computing tasks. Google and others appear to be pushing in a similar manner (they actually "predicted" that in about a decade programmers will be largely obsolete with machine-written software filling pretty much every niche.)
  The alternative is basically Linux - which still requires a huge learning curve for the average user with sub-par product suites AND hardware costs that can
  t compete with cloud-based packages (at least not until a critical mass of end-users have switched to the cloud and they can jack up rates.) Security is hardly even a concern on anyone's mind because everyone benefits from indemnification by saying "our data is hosted by Microsoft" as opposed to "our data is hosted in our rack secured by this weird troll of an IT guy."
15. Re:Can a corporate security officer comment by reggie6311 · 2015-12-29 02:05 · Score: 5, Informative
  
  I find this to be rather difficult to properly converse about. While I'm not a CISO per say, I consult many CISO's regularly and this is one of the topics that have come up recently and has opened up a lot of interesting discussions. To clear the air, Windows 10 Enterprise (and Windows 10 Professional) do not give you the ability to store Bitlocker keys with Microsoft when joined to Active Directory, nor do they automatically upload the keys. When joined to Active Directory, you have 3 options for key backup: Printing a Copy, Saving it to a file, Saving it to a USB key. Behind the scenes (not visible to the end-user), there is a 4th option in which you can require that the joined computer store a backup copy of the key on the computer object within Active Directory. This must be configured in AD and deployed as a GPO to the computers otherwise this backup option will not take place. The option to backup to a MS account is not available, even if you add a MS Account to the workstation. Now, to be transparent, none of the large (Fortune 500 or bigger) companies that I consult are using Bitlocker (rather, they are using various third-party drive encryption systems). Now, that isn't to say that there aren't any, just not the ones that I consult. However, several of my medium enterprise clients are. All of the discussions have all been centered around where to store recovery keys for the purpose of the business being able to decrypt a system if needed by an authorized administrator. This has caused a lot of issue because for my clients that are using Bitlocker, a few of them have considered moving to Azure AD (Active Directory run by Microsoft in the Cloud). My concerns about this have been that if you are using AD as a recovery for Bitlocker and you move AD to the cloud, this effectively does exactly what a MS account does to the home computer... puts the encryption keys in the hands of Microsoft. Now, not all of my medium enterprise clients are considering this, but of the few that are, we haven't been able to get clear information from MS on who all would have access to Azure AD and what their policies are.
16. Re:Can a corporate security officer comment by ArmoredDragon · 2015-12-29 02:10 · Score: 5, Informative
  
  Even if you do consider Windows 10 (or 8 for that matter) don't under ANY circumstances use a Microsoft account to log in. Recall not long ago during Microsoft's "Scroogled" campaign, they were promising account privacy and that they'd never look into your account at all. Well sometime during all of that, they broke into a blogger's hotmail account (read: he was their own customer) to identify his leak source for future MS products, right after saying that "oh, well now we really mean it this time."
  The problem with a Microsoft account is that your computer now answers to Microsoft's authentication servers, which means they ultimately hold the keys to unlocking your computer. In scenarios such as the above, or a government request, or social engineering, practically anybody could unlock your computer.
  As I've said elsewhere, there's no practical benefit to having one (you can still download apps and whatnot without using a Microsoft account to log in to your PC) so why needlessly expose yourself to the above risk?
17. Re:Can a corporate security officer comment by will_die · 2015-12-29 02:15 · Score: 1
  
  Unfortunately that is the skill level of the majority of the security people, and 98% of those with a CISSP. The rest say lets review the security policies and make sure those capability are turned off.
18. Re: Can a corporate security officer comment by Cro+Magnon · 2015-12-29 02:17 · Score: 2
  
  Maybe the point can't talk.
  
  --
  Slow down, cowboy! It has been 4 hours since you last posted. You must wait another few hours.
19. Re:Can a corporate security officer comment by Holi · 2015-12-29 02:26 · Score: 0
  
  Sure. Your not going to use a Microsoft account on your corporate system and this doesn't affect AD domain accounts. So no not an issue there.
  
  --
  Sorry, teleporters just kill you and then make a copy. A perfect, soul-less copy.
20. Re:Can a corporate security officer comment by Anonymous Coward · 2015-12-29 02:32 · Score: 1
  
  You better recheck your EULA.
  The wording (for all versions I've seen) gives Microsoft the right to install anything it wants, and to take anything it wants.
21. Re:Can a corporate security officer comment by Anonymous Coward · 2015-12-29 02:32 · Score: 0
  
  You look in a mirror again?
22. Re:Can a corporate security officer comment by TangoMargarine · 2015-12-29 02:34 · Score: 0
  
  that is a totally out of context comment from an anonymous poster.
  What do you fucking expect?
  
  --
  Unity? Screw that: XFCE. Slashdot Beta? Screw that: SoylentNews. Australis? Screw that: Pale Moon. UX developers DIAF
23. Re: Can a corporate security officer comment by Anonymous Coward · 2015-12-29 02:34 · Score: 0
  
  No - ALL versions have it. You just get the "feel good" option of turning it off (assuming the "off" actually works, and doesn't get turned on by some patch or other).
24. Re:Can a corporate security officer comment by ray-auch · 2015-12-29 02:34 · Score: 4, Interesting
  
  Good summary - unfortunately I don't have mod points today
  I would add that the likely reason we can't get clear info from MS about Azure AD is that Azure is international and located in multiple regions / jurisdictions and I think the court cases are still ongoing about whether or not the US can short-circuit international treaties and local laws elsewhere and force MS to hand over data located in other jurisdictions. So, MS basically don't know.
  It's safest to assume that govts are always likely to be able to get hold of keys whether stored on your own recovery server or with MS, and the likelihood rises with size of govt concerned...
25. Re:Can a corporate security officer comment by Anonymous Coward · 2015-12-29 02:41 · Score: 0
  
  I would like to know the opinion of large public corporations security officer on this feature of windows.
  "Nobody ever got fired for buying Windows."
26. Re:Can a corporate security officer comment by PopeRatzo · 2015-12-29 02:41 · Score: 1
  
  We're moving to TempleOS, not that it's any of your business.
  I'll only work for companies that adopt enterprise BeOS.
  
  --
  You are welcome on my lawn.
27. Re: Can a corporate security officer comment by GrantRobertson · 2015-12-29 02:47 · Score: 1
  
  Well, the point doesn't "speak to me" because I won't be using an enterprise license or logging into AD.
28. Re:Can a corporate security officer comment by Anonymous Coward · 2015-12-29 02:51 · Score: 0
  
  As I've said elsewhere, there's no practical benefit to having one (you can still download apps and whatnot without using a Microsoft account to log in to your PC) so why needlessly expose yourself to the above risk?
  Because they didn't by the pro version and have to use the Microsoft account.
29. Re:Can a corporate security officer comment by bfpierce · 2015-12-29 02:52 · Score: 1
  
  I think I'd be more concerned with the corporate security officer that's pushing signon with your microsoft.com account rather than say, your active directory...
30. Re:Can a corporate security officer comment by mysidia · 2015-12-29 03:19 · Score: 2
  
  As an IT technical admin of a non-public corporation; I will say that many of the cloud features of Windows 10 scare me greatly, and I would have many concerns to address moving forward.
  I do not believe it is necessarily justifiable that they block all deployment, but we may add special in-house requirements and restrictions on deployment, as we see necessary.
  For example: we may need to take steps to disable or interrupt features considered a risk.
  We expect our endpoints to not upload sensitive encryption keys to Microsoft (or partner) servers outside our control.
31. Re:Can a corporate security officer comment by Anonymous Coward · 2015-12-29 03:25 · Score: 0
  
  Wow, it's like reading Proust.
32. Re:Can a corporate security officer comment by Kjella · 2015-12-29 03:27 · Score: 3, Insightful
  
  Because they didn't by the pro version and have to use the Microsoft account.
  This is simply false. So far, at least.
  
  --
  Live today, because you never know what tomorrow brings
33. Re:Can a corporate security officer comment by epyT-R · 2015-12-29 03:33 · Score: 1
  
  Windows 7, office 2013 probably.
34. Re:Can a corporate security officer comment by Anonymous Coward · 2015-12-29 03:51 · Score: 0
  
  > large corporate entities will not deploy windows 10 for years anyway
  I know some large government entities who are already pushing us for win 10 support. I'm sure they'll use the corporate edition and maybe even force through some changes of their own for things like this, though.
35. Re:Can a corporate security officer comment by interval1066 · 2015-12-29 03:54 · Score: 1
  
  dissatisfaction? I'll say. Windoiws 10 (or 10.1, or something) brings NO must-have features as far as I can tell. Still, I wanted to try it, so I bought a windows tablet, a cheap British-made "Jumpstreet" (something like that) that came with windows 8. Knowing I would get an icon at some point for the upgrade from 8 to 10, I played with 8 and bided my time. Quick impression of 8: its windiws with a touch screen interface. Completely inappropriate for a touch screen. Besides the small screen the objects on the interface are tiny; my huge hamfist fingers had a hard time navigating the interface. I suppose there's a way to increase the size of the buttons and doodads but then the icon for the upgrade appeared a few days later so I pushed the button, Same thing in my mind, its windows with a touch interface chunked on top, with a few more utilities. I don't use that tablet much, and I won't be upgrading to 10 until something forces me to. Much like Ubuntu's switch to unity; when that happened I switched to Mint.
  
  --
  Python: 'And then suddenly you have a language which says "we're all stuck with whatever the whiniest coder wants".'
36. Re: Can a corporate security officer comment by Archangel+Michael · 2015-12-29 03:57 · Score: 1
  
  The point is moo.
  
  --
  Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
37. Re:Can a corporate security officer comment by Grishnakh · 2015-12-29 04:32 · Score: 1
  
  Hopefully this is one of those features Microsoft will allow you to turn off in the Enterprise SKU.
  No, hopefully not. I'd rather see MS force their corporate customers to link their AD servers to MS's, and send all their encryption keys to MS's servers.
38. Re:Can a corporate security officer comment by Anonymous Coward · 2015-12-29 04:36 · Score: 0
  
  We just disable any ability to log in the the Microsoft account via gpo. We should probably do it with local policy too if the machines ever drop out of ads for any reason.
39. Re:Can a corporate security officer comment by Anonymous Coward · 2015-12-29 04:39 · Score: 0
  
  I pity your company for having an admin that is clueless as you are. You are an idiot and shouldn't be in charge of a paper weight.
40. Re:Can a corporate security officer comment by phantomfive · 2015-12-29 04:56 · Score: 1
  
  large corporate entities will not deploy windows 10 for years anyway due to incompatible or uncertified line of business software platforms.
  Your post is good, and I understand why large corporations wait for software platforms to be certified, but my question is, are there known incompatibilities in Windows 10? OR is it still more of a theoretical thing?
  
  --
  "First they came for the slanderers and i said nothing."
41. Re:Can a corporate security officer comment by phantomfive · 2015-12-29 05:02 · Score: 1
  
  It's safest to assume that govts are always likely to be able to get hold of keys whether stored on your own recovery server or with MS, and the likelihood rises with size of govt concerned...
  Indeed, MS is most likely obligated to turn those keys over.
  
  --
  "First they came for the slanderers and i said nothing."
42. Re:Can a corporate security officer comment by fustakrakich · 2015-12-29 05:09 · Score: 1
  
  Besides, using Win 10 without a touch screen kinda defeats the point of having it at all. Win 7 will die off with the hardware that can run it unless it's done in a VM. I sure wish EOL meant the end of copyright/patent privileges so independent support could continue.
  
  --
  “He’s not deformed, he’s just drunk!”
43. Re:Can a corporate security officer comment by Anonymous Coward · 2015-12-29 05:10 · Score: 0
  
  Windows 10 does have a must-have feature!
  Micro$oft must have your money.
44. Re: Can a corporate security officer comment by Anonymous Coward · 2015-12-29 05:12 · Score: 2, Informative
  
  Fun fact: telemetry cannot be disabled in the Enterprise version either.
  Set it to "disabled" and it goes to the "Security" level. Source:
  https://technet.microsoft.com/library/mt577208%28v=vs.85%29.aspx
45. Re:Can a corporate security officer comment by fustakrakich · 2015-12-29 05:16 · Score: 1
  
  As I've said elsewhere, there's no practical benefit to having one...
  Sure there is. They make great throw away accounts to collect spam from all the porn sites you have registered with.. And personally, I like that you can white list your inbox to contacts only. Nobody else offers that. And there is the 15gb of storage..
  None of this really matters. The entire internet is being heavily monitored. A connected machine is not safe from any of it.
  
  --
  “He’s not deformed, he’s just drunk!”
46. Re:Can a corporate security officer comment by ADRA · 2015-12-29 05:23 · Score: 1
  
  Windows 'OS' has had little new to give enterprises for a long time (For at least a decade). Why do you see basically all new enterprise offerings going multi-platform and open web / XML standards? The only enterprise areas Microsoft is dominating are Office / Exchange / SharePoint / SqlServer (though largely used by other MS products) / AD (though this seems more a dodo waiting for obsolescence).
  
  --
  Bye!
47. Re:Can a corporate security officer comment by epyT-R · 2015-12-29 05:24 · Score: 1
  
  Why?
48. Re:Can a corporate security officer comment by Anonymous Coward · 2015-12-29 05:28 · Score: 0
  
  You can easily disable all logins to Microsoft.com via GPO as well as the Store and other unwanted features in a corporate environment.
49. Re:Can a corporate security officer comment by unixisc · 2015-12-29 05:47 · Score: 1
  
  moreover, this has to do with logging into your microsoft.com account, nothing to do with windows 10 pro joined to a domain.
  So this applies only to Microsoft employees, right? Or anyone with a hotmail, outlook.com or live.com account?
50. Re:Can a corporate security officer comment by Ubi_NL · 2015-12-29 05:50 · Score: 1
  
  Thats what i thought as well. But i work for a fortune-100 company and we roll out win 10 at this moment (for new machines though).
  
  --
  
  If an experiment works, something has gone wrong.
51. Re:Can a corporate security officer comment by Anonymous Coward · 2015-12-29 05:53 · Score: 0
  
  I am willing to wager that most corporate security officers wouldn't allow employees to log in to their corporate PCs with Microsoft accounts.. so this isn't a major issue.
52. Re:Can a corporate security officer comment by myowntrueself · 2015-12-29 06:34 · Score: 1
  
  Because they didn't by the pro version and have to use the Microsoft account.
  This is simply false. So far, at least.
  To the best of my knowledge...
  If you don't have the pro version you can only set up a Windows 10 box without the Microsoft account if it isn't connected to the Internet at setup time. if its got internet connectivity you don't get an option to set up with only a local account.
  
  --
  In the free world the media isn't government run; the government is media run.
53. Re:Can a corporate security officer comment by ArhcAngel · 2015-12-29 06:35 · Score: 1
  
  Thanks for that. I had a good chuckle.
  
  --
  "A person is smart. People are dumb, panicky dangerous animals and you know it." - K
54. Re:Can a corporate security officer comment by Anonymous Coward · 2015-12-29 06:35 · Score: 0
  
  Any CIO will still say that more cloud is better and we must buy even more cloud!
55. Re:Can a corporate security officer comment by Anonymous Coward · 2015-12-29 06:41 · Score: 1
  
  Because that would force them to understand finally that Microsoft's business model is not theirs.
  Corporations these days are basically IT companies that also happen to do "one other thing" like extract oil, manufacture toys, deliver food to restaurants, etc. Microsoft may not exactly be their enemy, but neither is it really their friend. If they want control of their own activities, they need to be willing to put in the effort (a.k.a. $$$) to be capable of running if/when Microsoft makes a choice that is right for Microsoft but catastrophically wrong for their corporate licensees.
56. Re:Can a corporate security officer comment by Dins · 2015-12-29 06:48 · Score: 1
  
  Yep, I can confirm this. I have the Home version at home and I do not have to log in to a MS account.
  I wouldn't be using Windows at all except I'm a gamer. Yes, Linux gaming is getting better all the time and that's great. But right now Windows is still the gaming OS. In retrospect, I wish I would have stuck with Win 7 as long as possible.
57. Re:Can a corporate security officer comment by epyT-R · 2015-12-29 07:03 · Score: 1
  
  I figured that was the reason. Thanks.
58. Re: Can a corporate security officer comment by Anonymous Coward · 2015-12-29 07:17 · Score: 0
  
  Hell, most of us have only just migrated the majority of systems to windows 7.
59. Re:Can a corporate security officer comment by Anonymous Coward · 2015-12-29 07:17 · Score: 0
  
  Nothing in this article has any impact on enterprise customers and despite all the fear mongering, nothing has changed (in terms of security) between Windows 7 and 10 for enterprise customers. Your IT staff area probably fairly incompetent at their job (sadly not uncommon) and make business decisions based on random consumer targeted click bait articles instead of actually reading the documentation.
  The article is actually quite misleading, but even it says that this would only impact Windows 10 Home edition (not Pro or Enterprise) which previously didn't have any encryption at all.
60. Re:Can a corporate security officer comment by epyT-R · 2015-12-29 07:20 · Score: 1
  
  If you're right, it sounds like people with half a brain should start removing every dependency their lives have on any sort of computer technology. The alternative is being owned (owned and pwned?) by a software company and/or their friends in government.
  Sad.
61. Re:Can a corporate security officer comment by epyT-R · 2015-12-29 07:22 · Score: 1
  
  I love your detailed description of 'why' this is the case. May I subscribe to your newsletter?
62. Re:Can a corporate security officer comment by Anonymous Coward · 2015-12-29 07:46 · Score: 0
  
  Good post, but I just want to point out that any company putting their AD system on Azure is already trusting their environment to MS regardless of bitlocker use or not. For most small or medium companies it's probably acceptable, for companies that can't do that they should be running their own AD servers anyway.
  Azure AD is mostly targeted at smaller companies that want the benefits of AD, but don't have the resources to built/maintain it all from scratch.
63. Re:Can a corporate security officer comment by Anonymous Coward · 2015-12-29 07:56 · Score: 0
  
  You can log in with a local account on Home editions and all other editions of Windows. You clearly don't have any real experience with the topics you are talking about.
  Also, there is a huge difference between Google reading through user's files by design and as their business model, and MS reviewing a single specific account on their own servers as part of a criminal investigation. I have seen a lot of (clueless) people claim they should have gotten a search warrant, but that is simply ignorance of the law. A search warrant is something issued to *law enforcement* so they can *forcibly* search a property. Non-law enforcement entities can't get search warrants and you don't need a search warrant to look inside your own home after a theft has occurred.
64. Re: Can a corporate security officer comment by Anonymous Coward · 2015-12-29 08:02 · Score: 0
  
  ^ lol this. No need to rush. Atleast good businesses don't.
65. Re: Can a corporate security officer comment by Anonymous Coward · 2015-12-29 08:07 · Score: 0
  
  Why would anyone register for a porn account. Porn is free as in freedom :P. I have no idea why people pay for porn these days.
66. Re:Can a corporate security officer comment by cjjjer · 2015-12-29 08:25 · Score: 1
  
  Considering that large companies probably will disable this feature using a gpo (being able to add and or log in using a Microsoft account) it's probably not even an opinion worth asking.
67. Re:Can a corporate security officer comment by war4peace · 2015-12-29 08:28 · Score: 0
  
  That's BS. Large corporations can and do request Microsoft to hand them complete documentation on how to modify, alter, disable features under Windows 10. Furthermore, large corporations already operate behind proper firewalls which block certain data from being transferred to Microsoft servers.
  The corporation I work for already rolled out a windows 10 pilot, and guess what? All the telemetry feature are inactivated by default. Amazingly, Cortana works - because it points to servers within the company's internal network.
  
  --
  ...gis sdrawkcab (usually not responding to ACs; don't bother posting as AC)
68. Re:Can a corporate security officer comment by PCM2 · 2015-12-29 08:34 · Score: 1
  
  Besides, using Win 10 without a touch screen kinda defeats the point of having it at all.
  You're thinking of Windows 8. Windows 10 tries to cater to desktop machines more, and in the process it actually degraded the experience on tablets in various ways (smaller onscreen controls, gesture actions removed, onscreen keyboard acts in unpredictable ways, etc.)
  
  --
  Breakfast served all day!
69. Re:Can a corporate security officer comment by fizzer06 · 2015-12-29 08:37 · Score: 1
  
  You called it a "feature". Just . . . damn.
70. Re:Can a corporate security officer comment by PCM2 · 2015-12-29 08:39 · Score: 1
  
  Indeed, MS is most likely obligated to turn those keys over.
  Not in all cases. One particular one that I'm aware of was where a US court ordered Microsoft to turn over one of its customers' data, but Microsoft responded that the data in question was not hosted in the US and therefore the court had no jurisdiction to seize it. I think Microsoft is still battling it out with the US government on that one.
  
  --
  Breakfast served all day!
71. Re:Can a corporate security officer comment by Grishnakh · 2015-12-29 08:45 · Score: 1
  
  Thank you, that's pretty much what I had in mind, but a little more extreme: I *want* to see MS push their customers away so that they'll be finally forced to abandon MS, or get burnt so badly by sticking with them that their competition drives them out of business.
  I'd rather see a world where all these "IT companies" as you put it are actually mostly in control over their own destinies (at least with the IT stuff), rather than all of them being on the MS bandwagon.
72. Re: Can a corporate security officer comment by Skuld-Chan · 2015-12-29 09:25 · Score: 1
  
  So you can turn off Microsoft accounts by policy, and the long term servicing branch has little support for these features.
  Also my end customers don't have local admin (which you need to encrypt the system yourself - outside our solution).
  Anyhow that has been my solution for this sort of thing.
73. Re:Can a corporate security officer comment by Anonymous Coward · 2015-12-29 09:29 · Score: 0
  
  large public corporations don't deploy the Home version so it's really not an issue for them
74. Re:Can a corporate security officer comment by Darinbob · 2015-12-29 09:58 · Score: 1
  
  Windows 8 made it seem lik you had to have Microsoft account. The option to use a local login only was hidden. If you didn't do the research you wouldn't know it was an option. So with Windows 10 you do the same thing: do the research before installing, and don't just click "next" over and over until you're done.
75. Re:Can a corporate security officer comment by Sir+Holo · 2015-12-29 10:00 · Score: 1
  
  Yep, I can confirm this. . . In retrospect, I wish I would have stuck with Win 7 as long as possible.
  I still run XP.
  In VM-Ware, under Mac OS X, only in the rare instances where a technical application is only available under Windoze (usually an application that a friend wrote, amounting to little more than a script).
76. Re: Can a corporate security officer comment by Anonymous Coward · 2015-12-29 10:59 · Score: 0
  
  I spent about 10 minutes trying to work out how the he'll to log into it without giving ms credentials for exactly that reason.
  did anyone not expect this?
  nearly sent the damn thing back before I found the microscopic text that let me skip it.
77. Re: Can a corporate security officer comment by Anonymous Coward · 2015-12-29 11:04 · Score: 0
  
  This.
  Unless you go into GPE and the registry to make sure everything is disabled, because the "Privacy" settings have proven to be complete placebo bullshit that do nothing, AND constantly monitor your network usage and background processes to make sure Spyware 10 isn't sneaking anything by or that the latest patch didn't "accidentally" reenable spying, then Spyware 10 is a horrible choice for anyone who even has a passing interest in security or privacy.
78. Re:Can a corporate security officer comment by Fire_Wraith · 2015-12-29 11:07 · Score: 1
  
  Which may work for you, but those who want full access to the ecosystem of PC games already have enough to deal with, without the rest of the hassles. Windows 10 is fine - you just have to know to turn the 'services' you don't want off, and never, under any circumstances, trade your local user account for a Microsoft cloud account.
79. Re:Can a corporate security officer comment by myowntrueself · 2015-12-29 11:17 · Score: 1
  
  Windows 8 made it seem lik you had to have Microsoft account. The option to use a local login only was hidden. If you didn't do the research you wouldn't know it was an option. So with Windows 10 you do the same thing: do the research before installing, and don't just click "next" over and over until you're done.
  Well yeah. But the only way I have found to install with local login is to disconnect. Are you sure theres another way? (This is for OS install time only).
  
  --
  In the free world the media isn't government run; the government is media run.
80. Re:Can a corporate security officer comment by Anonymous Coward · 2015-12-29 11:28 · Score: 0
  
  Your knowledge is faulty :-)
  When setting up Windows 10, it has a skip button on the Microsoft account page. When you click it, it then permits a local user account.
  Not intuitive, but possible and easily implemented nonetheless.
81. Re: Can a corporate security officer comment by justthinkit · 2015-12-29 11:32 · Score: 1
  
  Registering with web sites that have comment systems is often the only option if you wish to post comments. These days.
  
  --
  I come here for the love
82. Re:Can a corporate security officer comment by Anonymous Coward · 2015-12-29 11:32 · Score: 0
  
  This accounts for most delays but when it comes to any Government department, any company that deals in or with security systems, they won't touch Windows 10 either.
83. Re:Can a corporate security officer comment by Anonymous Coward · 2015-12-29 11:39 · Score: 0
  
  Yes. There are copious amounts of documentation about this online. I would advise it would be a better use of your time to just use some Google-Fu to confirm this ability instead of arguing with people who are (correctly) telling you this is possible (without disconnecting from the internet).
  I can confirm this was in-place when I first upgraded to Windows 10 Home from Windows 7 Home Premium. So unless Microsoft has removed this functionality in later versions of the installer (which I doubt), you can still do this.
  https://www.thurrott.com/windows/windows-10/4260/windows-10-drops-reliance-on-microsoft-account
84. Re:Can a corporate security officer comment by KGIII · 2015-12-29 12:03 · Score: 1
  
  A large corporation security officer that enabled logging in with Microsoft accounts as opposed to local accounts and AD would be a bit remiss in their duties. Their failure to have a preventative policy at the firewall also indicates that they probably should not hold that job.
  
  --
  "So long and thanks for all the fish."
85. Re:Can a corporate security officer comment by Anonymous Coward · 2015-12-29 12:11 · Score: 0
  
  Ummmm....
  Windows 10 caters heavily to desktop users. Further, it has many new features and technologies that make it an upgrade for touch and non-touch users alike. First and foremost in my mind, DirectX 12 (a huge upgrade for gamers once devs start utilizing it).
  In addition, as another poster mentioned, Microsoft backed off of many things that non-touch users hated in Windows 8 to make 10 more palatable to them. 2 examples come to mind without any in-depth thought on my part: return of the start menu and Windows Store apps being able to run in Windowed mode.
  Everyone is entitled to their own opinion but I am genuinely curious... have you actually... USED Windows 10?
86. Re:Can a corporate security officer comment by Anonymous Coward · 2015-12-29 12:14 · Score: 0
  
  Use a local account (as you should). Problem solved. Do not sign up for a Microsoft account during the install. Do not use that account if you have already made it. (I'm guessing about the process but it's pretty trivial to avoid that, from my understanding. I don't use Windows. I'm just not a frothy zealot.)
87. Re:Can a corporate security officer comment by KGIII · 2015-12-29 12:30 · Score: 1
  
  I have bumped into it before but, well, now I'm settled in Florida for the duration (probably until spring - though we may go to Nevada after the kids leave to resume their regularly scheduled lives) and I have VMWare. Well, it flaked out on a newer kernel but I should be able to get it squared away. I just haven't tried yet.
  It's an OS with a guide to talking in tongues and speaking with God and yet, oddly, I've never once booted a VM image of it. I mean, hell, I've got an image for MINIX, DLS, Puppy, Solaris, Indiana, etc... There's obviously something wrong with my life if I don't have TempleOS installed somewhere and I never have.
  This must be remedied, given a thorough review, and documented. I think after the NYE festivities, that might make a good (probably short) project.
  
  --
  "So long and thanks for all the fish."
88. Re: Can a corporate security officer comment by Anonymous Coward · 2015-12-29 12:36 · Score: 0
  
  Then don't use a Microsoft account, make sure you click skip and make a local account.
89. Re:Can a corporate security officer comment by whoever57 · 2015-12-29 13:48 · Score: 1
  
  "holy shit no. Windows 10 is not even being considered for corporate deployment"
  ... until that one PHB decides he can't live without Windows 10
  
  --
  The real "Libtards" are the Libertarians!
90. Re: Can a corporate security officer comment by Anonymous Coward · 2015-12-29 14:07 · Score: 0
  
  That, and it would be the stake in the heart of cloud computing and trusting others with your data once and for all.
  The way everyone plays fast and loose with everything lately, it's going to happen. It would be great if it happened to Microsoft but whoever causes it, the ultimate scandal will happen.
91. Re:Can a corporate security officer comment by AmiMoJo · 2015-12-29 19:40 · Score: 1
  
  That isn't quite correct. Before Windows 10 it was trivial to gain access to any Windows computer with physical access. Now some systems come encrypted by default, with the key securely stored in a TPM chip. If you use a Microsoft account the key is also uploaded to OneDrive, unless you disable that feature.
  This is a good thing for users. Encryption provides protection if they dispose of the drive, and even some if corrupt law enforcement tries to image it or install a rootkit. It makes extracting the user's Windows password harder. The online backup means that if their motherboard dies they can still recover the data.
  If you manually enable encryption you are given the option of uploading the key or saving it to a local drive, or even printing it out to use for emergency recovery later. Truecrypt offers the same feature.
  
  --
  const int one = 65536; (Silvermoon, Texture.cs)
  SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
92. Re:Can a corporate security officer comment by AmiMoJo · 2015-12-29 19:44 · Score: 1
  
  My company has started using Windows 10 on laptops being taken overseas for security reasons. As long as you don't tick the "upload my keys to OneDrive", or just disable OneDrive altogether via group policy, it's secure. It's better than 7 in fact, because it supports OPAL v2 on SSDs, and the boot environment is hardened against evil maid attacks.
  
  --
  const int one = 65536; (Silvermoon, Texture.cs)
  SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
93. Re:Can a corporate security officer comment by Gryle · 2015-12-29 21:54 · Score: 1
  
  You're referring to Microsoft Corporation v. United States of America. MS partially complied with a federal warrant by turning over information stored on US servers, but not information stored on servers located in Ireland. MS lost the original case and subsequent appeal, but is currently appealing to Second Circuit Court.
  
  --
  Only two things are infinite, the universe and human stupidity, and I'm not entirely sure about the universe - Einstein
94. Re:Can a corporate security officer comment by Z00L00K · 2015-12-29 22:17 · Score: 1
  
  Until you get your computer checked by TSA in the US, then you discover that they have the key to your hard drive. As long as it's just company items and some cached lolcats you are probably safe.
  
  --
  If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
95. Re:Can a corporate security officer comment by Z00L00K · 2015-12-29 22:21 · Score: 1
  
  I wouldn't say that they make the best development tools around, just that they are decent but still lacks some features that I expect while they have some unnecessary overhead as well.
  I just wait until the day some hacker is penetrating a major cloud service and uses the data there for malicious intent. That can result in a disaster for some major companies.
  
  --
  If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
96. Re:Can a corporate security officer comment by NicknameUnavailable · 2015-12-29 22:22 · Score: 1
  
  Every major cloud provider has been compromised, most not in several years but it has happened and chances are it will again. They cover it up as best they can.
97. Re:Can a corporate security officer comment by AmiMoJo · 2015-12-30 00:19 · Score: 1
  
  How would the TSA get the encryption key? Please explain how they can extract it from a TPM chip at the border. Or are you saying they pre-hack any company whose employees travel to the US and steal the keys from their Active Directory server in advance?
  
  --
  const int one = 65536; (Silvermoon, Texture.cs)
  SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
98. Re:Can a corporate security officer comment by Z00L00K · 2015-12-30 00:36 · Score: 1
  
  I wouldn't trust that the key won't be sent to a central server by the operating system. There are both intentional and unintentional holes in security everywhere.
  
  --
  If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
99. Re:Can a corporate security officer comment by godefroi · 2015-12-30 03:02 · Score: 1
  
  Cisco's old VPN client isn't compatible. Wasn't compatible with 8.1, or 8 either, though. Wasn't very compatible with 7, for that matter. Never tried it in Vista, but the last OS Cisco supported it on was XP. Around here, we're set to move off of it "very soon". That's the only piece of software I can think of off the top of my head.
  
  --
  Karma: Poor (Mostly affected by lame karma-joke sigs)
100. Re:Can a corporate security officer comment by Anonymous Coward · 2015-12-30 03:29 · Score: 0
  
  The ones using the consumer edition of Windows 10 and not a corporate edition, with domain joining features, BitLocker features, and/or using either edition and third party encryption software? They're probably wondering who modded you up to +5 since you think large public corporations use Windows 10 Home.
101. Re:Can a corporate security officer comment by sglewis100 · 2015-12-30 03:31 · Score: 1
  
  That person probably recommended not using Windows 10 Home. He or she probably recommends Windows 10 Pro or Enterprise, BitLocker, or a third party encryption solution.
102. Re:Can a corporate security officer comment by Anonymous Coward · 2015-12-30 03:37 · Score: 0
  
  So you bought a computer with a 7" touch screen and complain that the stuff on the screen's a bit small? This isn't an iPad or Samsung Galaxy. It's Windows 10. It's not really designed around 7" screens.
103. Re:Can a corporate security officer comment by gweihir · 2015-12-30 04:12 · Score: 1
  
  While I am not in that role, I know several larger organizations where Windows (typically Win7 at this time) is not allowed to phone home in any shape form or way. This is enforced by special, VPN-only network set-ups and corporate firewalls. Any updates come from their own servers, and these are handled very restrictively, both for security and for reliability reasons. All of these organizations just moved to Win7, Win10 will not even be considered for a long time yet. And clearly nobody is in favor of such a move. In fact, there is some activity to search for alternatives to Microsoft, but that is all in its early stages. People are simply unsure what to make about Microsoft's antics, but they are really concerned.
  Hence nobody in their right mind has trusted Microsoft for a long time anyways and large corporations have the means to enforce that technologically. Of course, ordinary users are screwed.
  
  --
  Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
104. Re:Can a corporate security officer comment by phantomfive · 2015-12-30 04:49 · Score: 1
  
  Oh yeah, I remember that breaking in 7, and trying to get off it.
  
  --
  "First they came for the slanderers and i said nothing."
105. Re:Can a corporate security officer comment by Anonymous Coward · 2015-12-30 05:49 · Score: 0
  
  IT Security Officer for a mid to large sized publicly traded venture capitalists software company with HIPAA/Financial & DoD contracts.
  This is a non-issue. A drive is decrypted once it boots anyway, encryption is for complaince and safeguarding against the majority of theft cases. Directed attacks from a determined person will almost always eventually succeed. Besides that, what's a disgruntled employee going to do? Track down our CFO and steal his laptop? We have much MUCH larger issues in security, you'd get more information from dialing in to his wide-open conference calls.
  For data that absolutely must be safe, we don't even put it on the computer, everything is done via remote presentation (XenApp) from our datacenters. This becomes necessary for BYOD and non-compliant devices like Macs that don't even have full AD integration or a TPM chip for encryption.
106. Re:Can a corporate security officer comment by Anonymous Coward · 2015-12-30 06:25 · Score: 0
  
  Another reason not to use this piece of Malware/Spyware posing as an OS.
Hmmmm by Vintowin · 2015-12-29 01:16 · Score: 2

How about you don't login with a Microsoft account? That'll show them!
1. Re: Hmmmm by Anonymous Coward · 2015-12-29 01:25 · Score: 0
  
  It might create a decryption key anyways and have it send to m$.
2. Re: Hmmmm by Anonymous Coward · 2015-12-29 01:26 · Score: 0
  
  Duh. That's too logical though. If you are a corporate user then you are using Active Directory and not a Microsoft Account.
3. Re:Hmmmm by messymerry · 2015-12-29 01:30 · Score: 0
  
  Then you don't get encryption. I fired M$ in '07. They were the first to jump up and down with both hands raided and pester the NSA to "Pick Me". Do "you" trust M$??? Linux rocks!!!
  
  --
  Dear Microlimp: I give you 2 valid product keys for win7 and you reject both of them. Piss off you wankers!!!
4. Re:Hmmmm by Z00L00K · 2015-12-29 01:30 · Score: 1, Troll
  
  And you think that actually helps? The key may already be uploaded and linked to your computer ID. The Microsoft account is just a decoy that they use to mislead and make you feel comfortable with getting some extras since they can confirm your identity even though they have statistically already determined your identity.
  
  --
  If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
5. Re:Hmmmm by Gojira+Shipi-Taro · 2015-12-29 01:38 · Score: 0, Flamebait
  
  I use my non-work PC to play games. I'm not going to limit myself to only the games that will run by one manner of hackery or another on Linux. I'm not going to "hold out" and "show publishers that they should port to Linux" because the only one that loses out there is ME. I don't get to engage in one of my primary forms of enjoyment, and the publishers that aren't already at least SteamOS friendly, will NEVER come around.
  I use Linux for work. Nothing more.
  
  --
  "Oh my God. This is terrible. This is the end of my Presidency. I'm fucked."; ~ Donald J. Trump
6. Re:Hmmmm by MatthiasF · 2015-12-29 01:46 · Score: 1
  
  Do you have any proof of this assertion?
  
  Furthermore, how is this any worse than Google's password manager behavior?
7. Re:Hmmmm by Z00L00K · 2015-12-29 01:52 · Score: 1
  
  It's worse because it's the key to the operating system itself, which would allow random attacker to gain control over your computer and access your data, possible even if it's encrypted with bitlocker.
  
  --
  If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
8. Re:Hmmmm by DigiShaman · 2015-12-29 01:56 · Score: 2
  
  Then you don't get encryption.
  You can still create a local account only in Windows 8 and Windows 10. Next, turn on BitLocker and record your own recovery key. All of this can be done OFFLINE!
  
  --
  Life is not for the lazy.
9. Re:Hmmmm by Anonymous Coward · 2015-12-29 02:08 · Score: 5, Funny
  
  When is this capability going to be added to systemd?
10. Re:Hmmmm by Ol+Olsoc · 2015-12-29 02:48 · Score: 1
  
  And you think that actually helps? The key may already be uploaded and linked to your computer ID.
  Their keylogger has already given it to them
  
  --
  The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
11. Re:Hmmmm by Lunix+Nutcase · 2015-12-29 02:56 · Score: 4, Informative
  
  Then you don't get encryption.
  Bitlocker works without a Microsoft account so this is patently false.
12. Re:Hmmmm by Lunix+Nutcase · 2015-12-29 02:58 · Score: 1
  
  Furthermore, how is this any worse than Google's password manager behavior?
  One is something you have to explicitly opt-in to use whereas the other is done without your consent?
13. Re:Hmmmm by Anonymous Coward · 2015-12-29 03:28 · Score: 0
  
  That's why I have two PC's at home, one running Linux, and another running Windows 7. The Linux one is the one that I do all of my personal computing on: personal work, internet browsing, hobbies, reading, media consumption, etc. I demoted my Windows box to 'game console' and use it to play the games (usually via in-home streaming) that won't run in Linux Steam or Wine or Crossover for one reason or another. Nothing personal goes on it since Microsoft has repeatedly demonstrated that they cannot be trusted.
14. Re:Hmmmm by Anonymous Coward · 2015-12-29 03:41 · Score: 0
  
  I've often wondered how difficult it would be to just install Windows inside a VM that is running on an encrypted Linux OS, then just play all your AAA DirectX Windows games that way.
15. Re:Hmmmm by interval1066 · 2015-12-29 03:58 · Score: 1
  
  There are native games for Linux, good ones too.
  
  --
  Python: 'And then suddenly you have a language which says "we're all stuck with whatever the whiniest coder wants".'
16. Re:Hmmmm by MatthiasF · 2015-12-29 04:03 · Score: 1
  
  You're forgetting about the Google Update service for Windows and Mac, and the deep integration of Google services into most version of Android.
  
  If anything, Google has had this very ability for years now and Microsoft is playing catch-up.
17. Re:Hmmmm by Anonymous Coward · 2015-12-29 04:04 · Score: 0
  
  I've often wondered how difficult it would be to just install Windows inside a VM that is running on an encrypted Linux OS, then just play all your AAA DirectX Windows games that way.
  It wouldn't be too tough, but modern DirectX in a virtualized Windows install is a less than satisfactory experience.
18. Re:Hmmmm by MatthiasF · 2015-12-29 04:05 · Score: 2
  
  Using a Microsoft account on Windows 8 or 10 is not necessary either.
  
  But I'm willing to bet a lot more people keep themselves logged in to Chrome all the time than use a Microsoft account on Windows 10.
19. Re: Hmmmm by Anonymous Coward · 2015-12-29 04:28 · Score: 0
  
  Wgaf. Once you go "online" again and allow updates, you do not get a clear picture of subsequent file manipulation from ms's cloud of BS.
20. Re:Hmmmm by Lunix+Nutcase · 2015-12-29 04:39 · Score: 0
  
  Cool story. So how is having to explicitly signing yourself into Chrome's password manager the same as Microsoft sending out your encryption keys without asking?
21. Re:Hmmmm by Grishnakh · 2015-12-29 04:40 · Score: 1
  
  I thought "AAA" games were ones which were pretty cutting-edge and resource-intensive. As such, that's the last kind of application you want to run inside a VM; the performance will probably be crap.
  If you just used Windows for some not-so-high-performance office applications or stuff like that, then yes, that's a good approach.
22. Re:Hmmmm by Anonymous Coward · 2015-12-29 05:45 · Score: 0
  
  (shrugs) You're shorting yourself then.
  I have a fairly large Steam library, about 1/3 of the games I own will run on SteamOS/Linux. Probably another 1/3 will run in WINE/Crossover.
  There's enough there to keep me busy for a very long time. And quite a few of the games are what most would consider top-shelf titles. If Project Vulkan takes off like NVIDIA/AMD/Valve hope, then there will be even more first release games running on Win/OSX/Linux right out of the starting gate.
23. Re:Hmmmm by hairyfeet · 2015-12-29 05:47 · Score: 1
  
  Not the poster but it looks like Windows 10 still has the keylogger from the beta running which means ANYTHING you type, including with the virtual keyboard? Is sent home to the mothership, along with samples of your voice and your webcam. Which of course means using a MSFT account means nothing, as once you type your key and/or passwords they have them and can then sell them or do as they see fit.
  Until someone shows a toll that can REALLY and truly remove the insane amount of spying, which as you can see from this partial list from MSFT is a couple exits past batshit levels? I'm advising my customers to treat Windows 10 like the only other software I deal with that phones home without user control...malware.
  
  --
  ACs don't waste your time replying, your posts are never seen by me.
24. Re:Hmmmm by unixisc · 2015-12-29 05:58 · Score: 1
  
  That's why I have two PC's at home, one running Linux, and another running Windows 7. The Linux one is the one that I do all of my personal computing on: personal work, internet browsing, hobbies, reading, media consumption, etc. I demoted my Windows box to 'game console' and use it to play the games (usually via in-home streaming) that won't run in Linux Steam or Wine or Crossover for one reason or another. Nothing personal goes on it since Microsoft has repeatedly demonstrated that they cannot be trusted.
  Similar to you, but one PC-BSD and another Windows 10 Bing (originally 8.1). The PC-BSd I do all my personal work on - banking, managing my credit card accounts and payments, internet browsing, media consumption, et al. The Windows box was what I bought b'cos my work required it for a Windows only application. That, and anytime I need to edit Office documents, or anything else that specifically needs Windows.
  For games, I currently play Civ IV on the Windows box, but I'm waiting until PC-BSD 11 includes a SteamOS jail in it, so that I can get and play Civ V in it. Civ IV doesn't play under Linux.
25. Re:Hmmmm by Anonymous Coward · 2015-12-29 06:15 · Score: 0
  
  I also fired M$ a very long time ago. I tried M$ 10 on a system and it lasted about 1 hour as it kept asking for my birthdate. No way in heck am I going to share identity theft information with an operating system.
26. Re:Hmmmm by WaffleMonster · 2015-12-29 06:32 · Score: 1
  
  Furthermore, how is this any worse than Google's password manager behavior?
  Like a washed up dictator hauled in front of the hauge to answer for their crimes popping off "but Hitler did it too" ? Like that worse?
  Please for the love of god enough bandwagon fallacies.
27. Re:Hmmmm by myowntrueself · 2015-12-29 06:47 · Score: 1
  
  Then you don't get encryption.
  You can still create a local account only in Windows 8 and Windows 10. Next, turn on BitLocker and record your own recovery key. All of this can be done OFFLINE!
  To the best of my knowledge it has to be done offline; if you have Internet connectivity you can't install 8 and 10 without a Microsoft account, it doesn't even give an option for local account unless you disconnect.
  
  --
  In the free world the media isn't government run; the government is media run.
28. Re:Hmmmm by epyT-R · 2015-12-29 08:05 · Score: 1
  
  For now..
29. Re:Hmmmm by cfalcon · 2015-12-29 09:20 · Score: 1
  
  Remember that Bitlocker is not included in most installs. This refers to the stripped down version "device encryption" included in Windows Home, which is the vast majority of Windows 10.
30. Re:Hmmmm by KGIII · 2015-12-29 12:41 · Score: 1
  
  Could you get PC-BSD to look good? I tried, I really tried. I just couldn't do it and I'm really not even remotely picky. I use LXDE, for FSM's sake. It just looks like a really bad remake of Windows 2000 by a five year old - no matter what I did. On the other hand, GhostBSD is absolutely beautiful and speedy as hell - even in a VM. No matter what I did with PC-BSD, I just couldn't get it to look better than a bad copy of Win2k. It's disappointing, really, because it seemed really stable and was otherwise fine.
  
  --
  "So long and thanks for all the fish."
31. Re:Hmmmm by Anonymous Coward · 2015-12-29 12:43 · Score: 0
  
  Click Skip.
32. Re:Hmmmm by Anonymous Coward · 2015-12-29 12:46 · Score: 0
  
  being an unemployed washout and doing a few odd jobs for your neighbors is a far cry from 'customers.' drink your disability check and let the adults talk, thanks
33. Re:Hmmmm by Anonymous Coward · 2015-12-29 13:29 · Score: 0
  
  You are mistaken - I've installed Windows 8, 8.1, and 10 numerous times (on virtual machines at work), and they all have a way to use a local account.
  With Windows 8, the "Sign in to your PC" screen has an option to "Sign in without a Microsoft account".
  With Windows 8.1, the above screen is now "Sign in to your Microsoft account", and you have to click "Create a new account" in order to get the option to "Sign in without a Microsoft account".
  With Windows 10, the "Make it yours" page has a "Skip this step".link, which creates a local account.
34. Re: Hmmmm by Anonymous Coward · 2015-12-29 14:12 · Score: 0
  
  So basically you shove aside principles for personal enjoyment and convenience. Got it.
35. Re:Hmmmm by Anonymous Coward · 2015-12-30 01:42 · Score: 0
  
  This is what I do, VM Player with Windows 7 on a three-year old machine running Mint natively (GTX670, 16 DDR3, i7). Skyrim runs as well as it does on my PS3 on comparable settings (so lower than you'd expect on a PC). Rayman Origins and BlazBlue run better than they do on my PS3.
  So generally I'd say this solution gives you a Windows gaming computer about as capable as a PS3. With a more recent graphics card you could probably get it up to PS4-levels (so low-end PCish). Serious gamers aren't going to be satisfied with that, but then a lot of AAA titles are being released for Linux as well now, so between the two I don't feel any great need for a dedicated Windows machine.
36. Re:Hmmmm by Anonymous Coward · 2015-12-30 03:42 · Score: 0
  
  I've often wondered how difficult it would be to just install Windows inside a VM that is running on an encrypted Linux OS, then just play all your AAA DirectX Windows games that way.
  You could always, you know, try it and see.
37. Re:Hmmmm by sglewis100 · 2015-12-30 03:43 · Score: 1
  
  Completely false. In your defense, the installer hides it a bit.
38. Re:Hmmmm by MatthiasF · 2015-12-30 05:47 · Score: 1
  
  You realize you need to explicitly sign yourself into a Microsoft account using Windows 10 to have the recovery keys transmitted?
  
  You simply can't see the similarities at all? Neither action is required and both lead to privacy endangering outcomes.
  
  On the one hand, you can turn your computer off, pull the hard drive out, store it securely, etc., and the fact you had the recovery keys copied means nothing. Hell, you could even remove the Microsoft Account, force the recovery keys to be recreated and you'll be safe. On the other hand, your account passwords have been sitting on someone's server on the Internet for months, accessed by any number of unknown people/systems, backed up to multiple locations and yet the moment someone grabs them there is nothing you can do to stop them from accessing any said accounts unless you know beforehand.
39. Re:Hmmmm by MatthiasF · 2015-12-30 05:57 · Score: 1
  
  Looks like you're talking about the Cortana features. You can turn them off and all those items listed (in the disclose.tv article) and much of the Microsoft list will stop.
  
  No one has actually proven that it records typing into Password boxes, though.
  
  In any case, most of these behaviors are already present in other software, like web browsers, and people do not seem to mind. Prefetching and auto-complete are pretty much the same as the Cortana "telemetry" mentioned.
  
  If you are really paranoid, I am sure someone has produced a hosts file you can use to stop all of them, including Microsoft, Google, etc.
40. Re:Hmmmm by Anonymous Coward · 2015-12-30 09:45 · Score: 0
  
  Then you don't get encryption.
  You can still create a local account only in Windows 8 and Windows 10. Next, turn on BitLocker and record your own recovery key. All of this can be done OFFLINE!
  To the best of my knowledge it has to be done offline; if you have Internet connectivity you can't install 8 and 10 without a Microsoft account, it doesn't even give an option for local account unless you disconnect.
  This is incorrect. It's neither intuitive nor easy to get to, but you can opt out of signing into a Microsoft account even while installing online.
41. Re:Hmmmm by hairyfeet · 2015-12-30 12:08 · Score: 1
  
  Did you bother to read TFL? They TURNED OFF CORTANA and it STILL keeps right on sending data showing that its bullshit, its keylogging. Type on the keyboard? Certain addresses are called, the same one called when you use the virtual keyboard. Turn on webcam? Different addresses, mike? Ditto. Sorry but that kind of behavior I see all the time at the shop....from malware.
  
  --
  ACs don't waste your time replying, your posts are never seen by me.
No they dont.... by Lumpy · 2015-12-29 01:17 · Score: 1

I dont have an encryption key! HA! Take that Microsoft!

--
Do not look at laser with remaining good eye.
Windows 10 seems... by Anonymous Coward · 2015-12-29 01:19 · Score: 0

...pretty unprofessional. Is any corporation going to use it? Why not just put all your files on TPB instead?
Cryptolocker defense? by nodetx · 2015-12-29 01:22 · Score: 0

Would that let you decrypt anything ruined by cryptolocker?
1. Re:Cryptolocker defense? by Anonymous Coward · 2015-12-29 01:32 · Score: 0
  
  Pretty sure cryptolocker is going to generate its own keys and not be using BitLocker.[like you should be doing]
You're an idiot. by Anonymous Coward · 2015-12-29 01:24 · Score: 0

Get off the interwebs.
1. Re:You're an idiot. by Anonymous Coward · 2015-12-29 01:43 · Score: 0
  
  look mommy, i can puter!!
Simply solution by Anonymous Coward · 2015-12-29 01:27 · Score: 0

Keep using Linux and fuck off with Windows. At least with Linux you can pick and choose which cryptography to use and even have full disk encryption why would anyone that holds customer data would even consider win10 is beyond me.
1. Re:Simply solution by Anonymous Coward · 2015-12-29 01:35 · Score: 0
  
  And if you want the Microsoft experience, you don't need Windows 10. Just use Kim Jong-Unix, er, North Korea's Red Star OS
This is why I've not tried Cortana by Anonymous Coward · 2015-12-29 01:30 · Score: 0

I'd love to give it a go, but for no good reason other than MS trying to snoop on you, you absolutely cannot use it without switching to MS account log in. Other apps like Feedback let you sign in for just that one app rather than force a take over of your entire system login.
password by Anonymous Coward · 2015-12-29 01:31 · Score: 1

Did you know if you log-in with you online user account they also have your password?! granted it is probaly hashed but those crafty Russian spies have their ways
1. Re: password by Anonymous Coward · 2015-12-29 03:45 · Score: 0
  
  If they're doing proper password management, they only store a salted hash of your password.
2. Re: password by Anonymous Coward · 2015-12-29 04:32 · Score: 0
  
  Yubikey is looking to be of very good use here. I suspect I will only install 10 at the very last second using two factor authentication.
If privacy is a concern, you don't use Windows 10 by Anonymous Coward · 2015-12-29 01:36 · Score: 0

I am now waiting for
"If privacy is a concern, you don't use Windows." Fixed that for you
and
"Don't use Windows." Fixed that for you.
slow news day? by Anonymous Coward · 2015-12-29 01:36 · Score: 0

https://www.reddit.com/r/crypto/comments/3f0j44/windows_10_backs_up_your_bitlocker_recovery_key/
Im pretty sure there was some slashdot article about this too.
Remember that it's a disk RECOVERY key by CajunArson · 2015-12-29 01:38 · Score: 2, Insightful

So one important thing to remember is that these keys don't give anyone a login or remote access to your box whatsoever. Instead, Windows 10 now turns on disk encryption by default. That's a good thing, but of only limited value since disk encryption really only helps if the disk is physically stolen from you.
So what we have here is a copy of the key that allows recovery of an encrypted disk being stored in the cloud unless you delete it. Not the greatest thing ever but it doesn't panic me all that much when the same people who scream about not upgrading to Windows 10 because OMG NSA are also running old systems without any disk encryption whatsoever.
To put it another way: The vast VAST majority of Linux systems in operation that don't use full disk encryption are actually LESS secure than this setup simply because there's no need to get your hands on a recovery key to decrypt anything. Yes, I'm well aware that Linux systems with full-disk encryption exist. So what, they did (and still do) on Windows too.

--
AntiFA: An abbreviation for Anti First Amendment.
1. Re:Remember that it's a disk RECOVERY key by Anonymous Coward · 2015-12-29 01:45 · Score: 0
  
  This just means that when the Feds raid your place...without your knowledge or consent, Mr. Softy will hand over the encryption keys that they have no business being in possession of to said Feds.
  Yeah, nothing wrong with that at all except it facilitates 4th amendment circumvention. You fucking imbecile.
2. Re:Remember that it's a disk RECOVERY key by nctritech · 2015-12-29 01:46 · Score: 1
  
  Windows 10 does not turn on disk encryption by default.
3. Re:Remember that it's a disk RECOVERY key by sasparillascott · 2015-12-29 01:59 · Score: 1
  
  But new systems are coming with it turned on by default (read the original linked article).
4. Re:Remember that it's a disk RECOVERY key by Opportunist · 2015-12-29 02:04 · Score: 4, Insightful
  
  So one important thing to remember is that these keys don't give anyone a login or remote access to your box whatsoever. Instead, Windows 10 now turns on disk encryption by default. That's a good thing, but of only limited value since disk encryption really only helps if the disk is physically stolen from you.
  Like, say, in a police raid.
  
  So what we have here is a copy of the key that allows recovery of an encrypted disk being stored in the cloud unless you delete it.
  Like, say, to gain access to the data after the raid.
  
  Not the greatest thing ever but it doesn't panic me all that much when the same people who scream about not upgrading to Windows 10 because OMG NSA are also running old systems without any disk encryption whatsoever.
  To put it another way: The vast VAST majority of Linux systems in operation that don't use full disk encryption are actually LESS secure than this setup simply because there's no need to get your hands on a recovery key to decrypt anything. Yes, I'm well aware that Linux systems with full-disk encryption exist. So what, they did (and still do) on Windows too.
  With the difference that I can actually create encryption on Linux with a chance that nobody but me gains access to the key.
  
  --
  We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
5. Re:Remember that it's a disk RECOVERY key by Anonymous Coward · 2015-12-29 02:18 · Score: 0
  
  So one important thing to remember is that these keys don't give anyone a login or remote access to your box whatsoever. Instead, Windows 10 now turns on disk encryption by default.
  Thank you for pointing this out, since the genius who drafted TFS felt it completely unnecessary to fucking explain the impact.
6. Re:Remember that it's a disk RECOVERY key by Perky_Goth · 2015-12-29 02:50 · Score: 2
  
  Like, say, in a police raid.
  See, that's not how you should put, because people will think you want to break the law free of charge.
  You should say corporate espionage helped by the US government and have a few links ready. That'll get their attention.
7. Re:Remember that it's a disk RECOVERY key by Anonymous Coward · 2015-12-29 02:52 · Score: 0
  
  Linux systems have a checkbox for install saying "encrypt disk". We just need to make that default.
8. Re:Remember that it's a disk RECOVERY key by Sloppy · 2015-12-29 03:07 · Score: 2
  
  Raids schmaids. In my experience, the most common case of data leaving the building are failing drives RMAed to manufacturer. I don't remember ever being raided but I have RMAed quite a few drives.
  That is why everyone should always be encrypting. So that the drive (which is different from the boot SSD which has the key file pointed at by /etc/crypttab) is just noise. Worrying about the feds is like worrying that you're going to be killed by a terrorist, when you ought to be getting more exercise and driving more defensively. Prioritize your threats!
  The Microsoft scenario isn't that they're going to hand your keys over to the feds. It's that a couple years from now we're going to be reading the news story that all Windows 10 users' keys were leaked in some unattributed breach.
  
  --
  As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
9. Re:Remember that it's a disk RECOVERY key by Opportunist · 2015-12-29 03:08 · Score: 4, Insightful
  
  Look at your laws. Then tell me with a straight face that you have not broken one of them today. Or in the last 60 minutes.
  
  --
  We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
10. Re:Remember that it's a disk RECOVERY key by Anonymous Coward · 2015-12-29 03:42 · Score: 0
  
  Doesn't the recovery key also require the password to fully unlock?
  I don't see why this is a big issue -- if anything, it'll be useful to the people who aren't techies - it's harder for malware to royally (irrecoverably) screw up a system.
11. Re:Remember that it's a disk RECOVERY key by Anonymous Coward · 2015-12-29 03:46 · Score: 0
  
  Even with the encryption key, you still need the unlock PIN/password. A raid would make it a little easier to unlock (especially if you use a pin and not a password), but still would not grant access to the data.
12. Re:Remember that it's a disk RECOVERY key by AC5398 · 2015-12-29 04:20 · Score: 1
  
  What on earth am I going to be doing on the home computer that requires me to encrypt the hard drive contents?
  Hint: Nothing!
  I'm already having issues with Windows not allowing me access into certain directories. 'Not authorized ...' But encrypting things is just asking for trouble.
  Once my current computer dies, the next computer will be running Ubuntu. I've just had it with Microsoft.
13. Re:Remember that it's a disk RECOVERY key by Anonymous Coward · 2015-12-29 05:18 · Score: 0
  
  You would probably -- at the very least -- want to encrypt things like credit cards, banking passwords, bank statements and so on. You never know who might be poking around your hard drive. It's a very connected world.
14. Re:Remember that it's a disk RECOVERY key by Anonymous Coward · 2015-12-29 06:29 · Score: 0
  
  You don't do taxes, electronic banking, online brokerage, company accounting, client's payment details, or similar on your computer? Fine, but one day when you come out of your mom's basement to join the grown-up world, then you should encrypt your disks though.
15. Re:Remember that it's a disk RECOVERY key by AC5398 · 2015-12-29 06:59 · Score: 1
  
  Dude, I do indeed work in the 'grown-up world' and the only way you can secure a computer is to bury it in the back yard. No, scratch that, the only way to secure a computer is to set it on fire and then bury it in the back yard. I don't do ANYTHING on the damn thing that I wouldn't want broadcast on the 5pm news.
  The work is done on a work laptop, and work secures that damn thing to whatever specs they like.
16. Re:Remember that it's a disk RECOVERY key by Anonymous Coward · 2015-12-29 08:04 · Score: 0
  
  You can also do this in Windows.
  This is much boring ado about nothing. This feature is fine and good for 95% of Windows users. If you want something stronger then use something stronger.
17. Re:Remember that it's a disk RECOVERY key by Xyrus · 2015-12-29 12:29 · Score: 1
  
  Obligatory XKCD: https://xkcd.com/538/
  Your encryption is only as strong as your resistance to being drugged and tortured. They don't even need to do that much. They could plant false evidence for whatever crime they wanted to get you for and throw you in a hole for the rest of your life.
  Encryption just means they have to do a little more work. If they're coming for you no matter what, they're going to get you. Period.
  
  --
  ~X~
18. Re: Remember that it's a disk RECOVERY key by Anonymous Coward · 2015-12-29 12:49 · Score: 0
  
  Seriously. None people are concerned about being raided by the feds over losing how to get into their own encrypted files.
  And if you're worried about the feds busting in, I *assume* you have a better defense than bitlocker.
19. Re:Remember that it's a disk RECOVERY key by Perky_Goth · 2015-12-29 16:15 · Score: 1
  
  I torrent every day (not really). I was just saying people think they don't break laws because they're not bad people and found another situation that might be understood better.
20. Re:Remember that it's a disk RECOVERY key by sglewis100 · 2015-12-30 03:48 · Score: 1
  
  You would probably -- at the very least -- want to encrypt things like credit cards, banking passwords, bank statements and so on. You never know who might be poking around your hard drive. It's a very connected world.
  That's not the same thing as needing to encrypt your entire hard drive.
21. Re:Remember that it's a disk RECOVERY key by david_thornley · 2015-12-30 07:50 · Score: 1
  
  However, if you're part of a general sweep, they aren't going to drug and torture you for your key. Of course, this violates the Fourth Amendment, so it never happens, right?
  
  --
  "When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
Non-issue for corporate? by Anonymous Coward · 2015-12-29 01:51 · Score: 0

It seems that this is for microsoft accounts, and I remember reading about this a while ago that it uploads to the onedrive.
If you have a corporate machine it should be domained and not using a microsoft.com account for your work thing.
Dovetails with new surveillance legislation by sasparillascott · 2015-12-29 01:56 · Score: 4, Insightful

Good to remember, that Congress just passed new (clearing companies to share any data with the NSA directly without liability) surveillance legislation tucked into the 2015 budget bill:

http://arstechnica.com/tech-po...

The way this (and the data uploading with Windows 10) dovetails with the budget spy bill just passed you'd think it was hatched out in a back room - in D.C.. Obviously don't use Windows 10 if possible (you can still get 7 or 8.1 on most systems) and don't use Microsoft's built in encryption option (which Microsoft kneecapped starting with Windows Version 8 by removing the elephant diffusor making it more vulnerable to brute force attacks), there are other options for Windows Encryption.
1. Re:Dovetails with new surveillance legislation by Anonymous Coward · 2015-12-29 02:23 · Score: 0
  
  hmm you can always use Linux!!
2. Re:Dovetails with new surveillance legislation by Anonymous Coward · 2015-12-29 02:25 · Score: 0
  
  I do believe we've reached the point where if you are using commercial software, it is prudent to assume that your personal data will be (1) sold for profit, (2) stored indefinitely, and (3) used against you as necessary. If our future is merely the logical extreme of all this -- where everything about a person's life is permanently recorded by corporations and government -- then I can honestly say that I no longer care about the future of humanity. My only request is that they save the nuclear holocaust until after I die.
3. Re:Dovetails with new surveillance legislation by Holi · 2015-12-29 02:39 · Score: 4, Informative
  
  "you can still get 7 or 8.1 on most systems"
  You haven't heard? Windows 10 Telemetry and spyware have been backported to Windows 7 and 8.
  http://www.extremetech.com/com...
  
  --
  Sorry, teleporters just kill you and then make a copy. A perfect, soul-less copy.
4. Re:Dovetails with new surveillance legislation by Anonymous Coward · 2015-12-29 02:45 · Score: 0
  
  (4) stolen and used against you anyway
5. Re:Dovetails with new surveillance legislation by jez9999 · 2015-12-29 02:53 · Score: 1
  
  Only if you install those particular updates. Set the update system NOT to auto-install and vet the updates every time.
  
  --
  == Jez ==
  Do you miss Firefox? Try Pale Moon.
6. Re:Dovetails with new surveillance legislation by Anonymous Coward · 2015-12-29 04:07 · Score: 0
  
  I do believe we've reached the point where if you are using commercial software, it is prudent to assume that your personal data will be (1) sold for profit, (2) stored indefinitely, and (3) used against you as necessary. If our future is merely the logical extreme of all this -- where everything about a person's life is permanently recorded by corporations and government -- then I can honestly say that I no longer care about the future of humanity. My only request is that they save the nuclear holocaust until after I die.
  Wow. I couldn't agree more. I too have come to the same conclusion about the future of human society, and where it is going. Its interesting that with all the problems facing mankind right now, "existential threats", if everything goes cheerily along, and mankind manages to work through all those problems, technology will still be churning along. What that means is the future you have described, which I hopefully will only see the beginning of...
7. Re:Dovetails with new surveillance legislation by Anonymous Coward · 2015-12-29 04:26 · Score: 0
  
  That used to be an option but from October or September forward (I forget which) MS no longer provide any significant information about what each update does, they only provide a title and at best very generic one or two line description - so now you can't even really tell what the fk a given update is really actually changing\adding.
8. Re:Dovetails with new surveillance legislation by Anonymous Coward · 2015-12-29 05:04 · Score: 0
  
  Good luck with that vetting. Not only is it a lot of work, have you seen how vague their descriptions are now? Give it a year or two and it'll be installed bundled with some critical security update.
9. Re:Dovetails with new surveillance legislation by Anonymous Coward · 2015-12-29 06:33 · Score: 0
  
  Cool, and you can tell which are those particular updates that you should not install, and you hope that MS will tell you the truth?
10. Re:Dovetails with new surveillance legislation by thegarbz · 2015-12-29 08:56 · Score: 1
  
  Set the update system NOT to auto-install and vet the updates every time.
  That may be fine for the very small portion of security concious out there, but what are the real alternatives?
  Run an insecure system?
  Run an up to date system with "telemetry"?
  One of those two is the situation most of the Windows world will face. Neither is good.
Nope...not me by p51d007 · 2015-12-29 01:59 · Score: 1

When I set up my computer, it stays OFFLINE until I'm finished setting it up. I don't logon with my hotmail account, so technically my key isn't there.
1. Re:Nope...not me by Anonymous Coward · 2015-12-29 06:03 · Score: 0
  
  Until you connect online then it pushes the key to them automagically.
2. Re:Nope...not me by Anonymous Coward · 2015-12-29 06:24 · Score: 0
  
  Same it must at least have:
  - Windows Updates are disabled ever since the telemetry back-port to 7. The whole update thing is too much to bother with now.
  - A host file blacklist (Spybot Search and Destroy - Immunization),
  - Software firewall (Agnitum Outpost Firewall Pro),
  - Spybot Anti-Beacon
  - A decent web browser (currently Pale Moon).
  Then I go online and get add-ons for the web browser and update and apply Spybot Search and Destroy Immunization.
PROXY, upload a FAKE key, simeple by Anonymous Coward · 2015-12-29 02:06 · Score: 0

PROXY, upload a FAKE key, simeple
"Hacker" read "NSA" by Anonymous Coward · 2015-12-29 02:11 · Score: 0

How American of you Microsoft. Pretend that this actually provides any kind of privacy to your users and "delete" their keys when requested.
Many things could happen...... by bev_tech_rob · 2015-12-29 02:11 · Score: 0

As soon as your recovery key leaves your computer, you have no way of knowing its fate. A hacker could have already hacked your Microsoft account and can make a copy of your recovery key before you have time to delete it. Or Microsoft itself could get hacked, or could have hired a rogue employee with access to user data. Or a law enforcement or spy agency could send Microsoft a request for all data in your account,
Or dogs and cats start sleeping together, or unicorns could start bombing us with rainbow shit, etc,etc.... ad nauseum.... sheesh....

--
You're messin' with my Zen Thing, man.....
Craziness by TimeOut42 · 2015-12-29 02:14 · Score: 1

The article states = 'Your computer is now only as secure as that database of keys held by Microsoft, which means it may be vulnerable to hackers, foreign governments, and people who can extort Microsoft employees.'
Yes, because your everyday user's are so much more capable of protecting their data on their computers.
Silliness...
1. Re:Craziness by brix · 2015-12-29 06:04 · Score: 2
  
  This.
  
  If Microsoft was forcing full-disk encryption on Windows 10 Home users (and I'm not convinced that they are), then it's still better than the alternative of having no encryption, right? Someone might argue that it's a "false sense of security" since you really don't know where the recovery keys could have gone, but I seriously doubt that most of these users would even know that they had encryption on anyway, so it can't be a false sense of security if you never knew you had the security in the first place.
  
  And I'm not convinced this is even that widespread. I've installed Win 10 Pro on several machines with the TPM chip enabled from a previous install, and none of them automatically encrypted. In each case, I had to manually turn on Bitlocker. I can't speak for Home installs, but having this "poor man's Bitlocker" seems an upgrade over the "no encryption at all" (or third-party) in 8.1 Home and before. And seriously, how many Home users have actually configured their TPM in the first place?
  
  Speaking as the "family tech support" guy, I'm happy that Microsoft went this route (again, if they did). It ensures that recovery is possible in case of the need to switch the drive to a new machine, without making me have to explain to each of my family members what to do during each install. And really, my advice for these users would be to let Microsoft manage it anyway. I wouldn't trust that they would print out a recovery key and put it in their safe (don't forget labeling it properly to make sure they knew which computer/drive it went with), purchase some storage media (e.g. flash drive) to keep in the safe, or safely store it in some other way. For these HOME users, having the recovery key in their MS account is "good enough", especially when they probably wouldn't have encryption otherwise.
  
  Side note: The fact that there are around 100 replies after the nonsensical question "Can a corporate security officer comment?" goes to show why Slashdot should put back in the "most recent posts first" sort order and have it as the default. This just isn't an issue for corporate use, since they are going to manage Bitlocker recovery keys themselves in AD. And yet then you get a dozen nonsensical replies that, "This is why no company would consider Windows 10."
  
  Why center the discussion around the person who put all of 10 seconds of thought into their "First post" when the better thought out posts will be further down?
2. Re:Craziness by Anonymous Coward · 2015-12-29 07:30 · Score: 0
  
  Exactly. These are also recovery keys for data at rest which has nothing to do with remote access by hackers, governments, etc. They would also need to have physical access to the device to make use of a recovery key.
  The article also fails to mention that this is for the *Home edition of Windows* only, which didn't previously have any built in encryption. So this is encryption of the physical device (which protects against physical theft, not hacking) for those that otherwise would have their data stored in the clear.
You can delete your key... wink wink nudge nudge by Anonymous Coward · 2015-12-29 02:19 · Score: 0

Sure, you can delete it. Really. Just try it. See it's gone. It really is. Wink wink nudge nudge.
Re:If privacy is a concern, you don't use Windows by Farmer+Tim · 2015-12-29 02:20 · Score: 1

Hey, at least it can't be shortened further to "Windows fixed that for you".

--
Blank until /. makes another boneheaded UI decision.
Re:If privacy is a concern, you don't use Windows by Anonymous Coward · 2015-12-29 02:39 · Score: 0

:-) You mean "Windows screwed that for you"...
Windows account? by truck_soccer · 2015-12-29 02:40 · Score: 1

I am 12 and what is this?
1. Re:Windows account? by Anonymous Coward · 2015-12-29 12:47 · Score: 0
  
  I am 12 and what is this?
  I am 45 and do not know what this nonsense is. Join the club.
Duh, that's how encryption works by iamacat · 2015-12-29 02:41 · Score: 1

Consider the alternative:
1. Encrypt the disk and login with Microsoft account
2. Forget the password, reset it from the web
3. Poof! You data is gone!
Maintaining strong security is not a joke. You have to memorize multiple long passphrases for different domains of protected data and never access stuff on devices that have ever left your custody. Like a laptop that has been left at home for NSA keylogger installation convenience. Be prepared to lose data and toss hardware on regular basis. I don't blame Microsoft for not making that the default setting, there is just no way to explain this to users who don't have specialized training.
1. Re:Duh, that's how encryption works by Anonymous Coward · 2015-12-29 02:52 · Score: 0
  
  There are two types of people - a) ones who care about privacy and data, and b) ones that don't. After this move by MS, group b) is substantially better-off and group a) is substantially worse-off.
  
  I presently use BitLocker with Win7. I have my recovery keys printed and stored in the safe. If I were to switch to Win10 (not that I would), I'd end up less secure. My elderly mother, on other hand, would be much more secure.
2. Re:Duh, that's how encryption works by Anonymous Coward · 2015-12-29 03:33 · Score: 0
  
  yea, and then disks firmware "caches" you password by talking over PCI to some fancy controller in chipset... thats conviniently can DMA the area where ya keyboad buffers characters.... wheres you messiah and security now, schmuck?
  ENCRYPTION IS USELESS WHEN DONE ON ENEMY-OWNED HARDWARE!11
3. Re:Duh, that's how encryption works by Anonymous Coward · 2015-12-29 03:49 · Score: 0
  
  Except you never had to create a MS account... If you're uncomfortable with MS's data retention policies, you can just simply not use them. Presumably if you are knowledgeable enough to create recovery keys (which is not what the article says MS stores, by the way), then you should be knowledgeable enough to turn off the said feature.
4. Re:Duh, that's how encryption works by iamacat · 2015-12-29 06:00 · Score: 1
  
  I don't know how strong is your safe or how resistant it might be to thieves or cops. Microsoft data centers are likely to have security guards and require some due process before handing out the key to authorities. Admittedly they are more vulnerable to massive theft of keys from many users at once through software or insider attacks. On the other hand, you are keeping key and lock in the same house.
  Regardless, you can switch to Win10 and NOT login with windows account. I think group a) just needs to be aware what implications of being able to reset a forgotten password and keep access to encrypted data are.
5. Re:Duh, that's how encryption works by brix · 2015-12-29 07:11 · Score: 1
  
  Hmm. I don't see that you'd have any problem either. If you already encrypt with Bitlocker on Win 7 (Pro, Ultimate, or Enterprise, obviously), then MS would have no way of getting your recovery keys post de facto, right? You'd have to unencrypt the disk, then install Win 10, then let MS re-encrypt it for you.
  Speaking of, I've installed Pro and Enterprise on several TPM machines, and Bitlocker has never automatically been enabled (unless through IT policies, in which case the recovery is backed up to corporate IT servers. In the case of Pro, it's always asked me if I want to store the recovery key with my Windows account, along with the other options of saving it to a file or printing it.
  I tend to think that this is, for the most part, only going to impact Home users who don't know how to otherwise use Bitlocker. It looks to me like a "poor man's Bitlocker" for Home users who didn't have the option before. In other words, Group B is going to be substantially better off, and Group A will be in the same position as they are now, because they'll be manually configuring Bitlocker on Pro or higher.
6. Re:Duh, that's how encryption works by epyT-R · 2015-12-29 09:16 · Score: 1
  
  How is your mom more secure with her keys in someone else's hand?
7. Re:Duh, that's how encryption works by sglewis100 · 2015-12-30 03:57 · Score: 1
  
  I just leave my key printed out and taped to the side of my computer, in case I ever need it. But seriously... for the vast majority of users, having it backed up to OneDrive is a great, great thing. I'm talking about the 99% of computer users who don't really know what this stuff is or how it works. For the rest of us, we can always follow the instructions, remove the key from OneDrive and ALSO change it to a new key.
  
  Incidentally, I understand how all of this stuff works, and really don't care, personally. I use Win 10 in a VM for work purposes, and don't store documents there, but I am using a similar feature on my main machine which is OS X. I do store my recovery key in iCloud. If my device was stolen, and they hacked iCloud, or social engineered their way in, they'd get banking information, credit card data, tax returns. I get all that. To me, there's such a minimal risk (the chance of my laptop being stolen is small. The chance of it being stolen by someone with hacking ability even smaller. The chance that someone with all those skills cares about my data is even smaller still) - I just don't care.
  
  This system is just fine for almost everybody. And the few that it isn't good for (not counting corporations who ought to be on Professional or Enterprise, and aren't subject to this system anyway) - they are smart enough (hopefully) to be here, and if they couldn't figure it out on their own, they've now seen 100 people link to 50 different blogs instructing them how to reinstall Windows without a Live account, decrypt and recrypt, remove the key from OneDrive, etc - there's half a dozen ways out of it even if you already had it happen to you and OH KNOWS my key is on OneDrive.
  
  I suppose a non-technical leaning child pornographer may have a problem one day stemming from this. Good.
A bit of a pain in arse by MarkH · 2015-12-29 02:53 · Score: 3, Interesting

But you can setup a windows 10 machine with all local accounts and all updates, traffic disabled.
Good guide here http://www.rockpapershotgun.com/2015/07/30/windows-10-privacy-settings/
Looking at wireshark it does seem to work
1. Re:A bit of a pain in arse by Anonymous Coward · 2015-12-29 10:28 · Score: 0
  
  Looking at wireshark it does seem to work
  It could be working... until Microsoft decides to alter the deal like how the telemetry updates were back-ported to Windows 7 and 8. Pray they do not alter it any further.
did we forget the edward snowden stuff already? by strstr · 2015-12-29 02:54 · Score: 1

this is no joke. the reason why Microsoft is saving the key is to hand to NSA. the key is not safe. encryption has been broken. every bit of data uploaded over the Internet is saved in NSA databases via upstream fiber tapping. the law didn't change that. even metadata is still being saved.
Microsoft is one of NSA's/DOD's biggest contractors. They secretly hand everything over to them. Your data is being hacked and snooped through even if no one tells you about it.
obamasweapon.com
1. Re:did we forget the edward snowden stuff already? by strstr · 2015-12-29 03:01 · Score: 4, Informative
  
  here's a few ways NSA is intercepting it.
  1. all data over the internet is being saved so they nab the key as it's being uploaded plus any other data communicated with Microsoft transparently as you use the net. ; if they want to gain legal authority to use the snoop'd data they go for a warrant and get it 'lawfully' from Microsoft, parallel constructing how their case was built. even if Microsoft encrypts the signal communications between their server and the end-user, the data is nabbed, and most definitely all of the encryption codes for end-user and Microsoft server software is de-decryptable by NSA because NSA has all of Microsoft's encryption certificates and has broken most encryption.
  2. alt method is Microsoft just gives them all the encryption certificates secretly even without a warrant.
  This has been explained before. Check out the Whistleblowers Websites on the issue.
  williambinney.com thomasdrake.xyz russelltice.com drrobertduncan.com
RE: I am 6 x 2 by davidwr · 2015-12-29 02:59 · Score: 2

"I am not a number. I am a free man."
Well, I was a free man until I logged in with my Microsoft account on my Windows 10 PC.

--
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Primer version anyone by RubberDogBone · 2015-12-29 03:09 · Score: 1

Can someone explain what all this actually means? Why should I care about this recovery key? I back up my own data so... if I had to do a recovery, I can certainly do that.
Not really any scenario where I would think of going to Microsoft to recover anything. What am I missing?

--
Sig for hire.
1. Re:Primer version anyone by wbr1 · 2015-12-29 03:37 · Score: 4, Informative
  
  It means MS has a copy of the keys to your bitlocker encrypted data. And by inference anyone with access to MS, hackers, government, disgruntled employees.. any could log into your computer and use the keys to unlock what you thought was encrypted and safe.
  
  --
  Silence is a state of mime.
2. Re:Primer version anyone by pr100 · 2015-12-29 03:52 · Score: 1
  
  You have a laptop running windows 10. The hdd is encrypted with bitlocker. MS have a copy of the recovery key.
  That means that, in theory, MS and anyone they're prepared to share the key with can decrypt the contents of your HDD.
  Presumably there was a reason that you encrypted your hdd in the first place, so there at least some people that you don't want to be able to decrypt it (otherwise encrypting it was a waste of time).
  One difficulty is that you can't know for sure who really can get hold of that recovery key - some MS employee being blackmailed by a third party, for example.
  Now on a practical level using Windows 10 and bitlocker, even given all of the above, is better than not encrypting at all. In the case of losing your laptop, with sensitive work materials on it ( a reason why many people encrypt HDDs) it's unlikely that whoever finds your laptop will be able to get hold of the recovery key from MS.
3. Re:Primer version anyone by Anonymous Coward · 2015-12-29 07:42 · Score: 0
  
  Just to clarify, the encryption functionality being discussed in the article is not exactly "BitLocker". The underlying technology is BitLocker, but the normal full BitLocker has options on where to store the recovery key (including local options, printed, etc.) and it's only offered in Pro/Enterprise editions of Windows. This article is talking about a new feature in the Home editions of Windows 10 that is known as "Windows Device Encryption." It is based on BitLocker, but it is mostly automated and stores the recovery key with the user's MS account. Previously, Home editions did not offer built in encryption at all so this is intended for non-tech savvy users that would otherwise have their data stored unencrypted.
  Leave it to Slashdot and the tech blogging community to somehow make it seem worse than the previous situation which was no encryption at all.
why are people still using windows by Anonymous Coward · 2015-12-29 03:16 · Score: 0

I can't believe this day and age people are still using windows. You get what you deserve!
Linux distros do the same by Anonymous Coward · 2015-12-29 03:17 · Score: 0

Linux distros do the same
or do they?
How do YOU know? Have you audited the distro? Has anybody done a PRIVACY AUDIT on Linux distros?
Or, did you fall for the assumption that Oh it's open source so it must be ok, and misplace your trust in the hope that somebody else says it's ok?
I think it is LONG OVERDUE that Linux Distros have a PRIVACY AUDIT (expecially commercial backed ones and most popular ones - RedHat and Ubuntu (Canonical) and any distros derived from them.
1. Re:Linux distros do the same by rubycodez · 2015-12-29 04:49 · Score: 1
  
  nonsense, instead use a distro (or other open source operating system for that matter) that is actually built for privacy and security as a prime consideration. There are Linux distros like that, and there is a BSD that is extremely like that
2. Re:Linux distros do the same by Anonymous Coward · 2015-12-29 08:45 · Score: 0
  
  I think all popular distros should be audited for privacy (like Truecrypt was).
  Peace of mind, Ubuntu is owned by Canonical.
  Did you know, the Linux kernel has UNLICENSED code in it? Check the Github and look for the firmware, lots of UNLICENSED (unknown licenses in it).
  https://github.com/torvalds/linux/blob/master/firmware/WHENCE -- look at those BINARY giblets and Licenses :)
  Betcha didnt know that :)
End-to-end encryption and "normal" users by GuB-42 · 2015-12-29 03:19 · Score: 4, Interesting

If encryption is turned on by default for normal users, there must be a way for the provider to recover the data.
People lose their passwords all the time, and don't want to lose all their data if that happens. For these people, disk encryption is just a way to prevent regular laptop thieves from accessing their data, not to protect them from the NSA and criminals who can hack Microsoft. They don't want end-to-end encryption.
If you need high level security even against Microsoft, then don't use your MS account, or better yet, don't use Windows.
1. Re:End-to-end encryption and "normal" users by StormReaver · 2015-12-29 15:30 · Score: 1
  
  ...or better yet, don't use Windows.
  I've been saying this for 20 years. Watching Windows users defend Microsoft's practices is a lot like watching a lobster defend rising water temperature in the cooking pot while the big guy in the white hat talks about seasoning.
Encryption by Anonymous Coward · 2015-12-29 03:24 · Score: 0

So , Windows 10 should only be run as a guest where the host machine's hard drive is encrypted, right?
Where the F Is.... by Anonymous Coward · 2015-12-29 03:39 · Score: 0

hackerman
He can figure this out with an atari and a laser disc.
Don't cherry pick by s.petry · 2015-12-29 03:40 · Score: 5, Interesting

While the main point of the article is about a Windows account there is an underlying discussion on overall privacy using Microsoft Windows. This is just the latest article discussing privacy and security concerns. Sure, "some" businesses are always years behind in releasing a new OS. Others are not so far behind, and are very concerned about security so not approving Win10.
For example, as soon as the OS was released we see how the OS will send your keystrokes to Microsoft. Not just what you type into Cortana, IE, or Edge but ALL keystrokes are recorded by the OS. You can disable sending the data to Microsoft, but we have yet to find a way of disabling the keylogger built in to the Kernel. (recorded does not necessarily mean stored long term, but long enough to evaluate in memory.)
Due to that lack of trust, I may have installed Win10 but never created a MS or Azure account. Anything I do on the device is treated as public knowledge because the OS is built to remove privacy from end users. I won't use online banking on the PC with Win10, and logging in to anything is assessed under the assumption that someone from MS and the Government will have full access to the account. When I'm working on sensitive stuff I use Linux.

--
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
1. Re:Don't cherry pick by Anonymous Coward · 2015-12-29 04:11 · Score: 1
  
  When I'm working on sensitive stuff I use Linux.
  Linux is no better than windows. The NSA is one of Red Hat's biggest customers. Red Hat has major influence on the Linux kernel and the base of modern distros, systemd. "A million eyes on open source code" thing is bullshit. Look at how long it took and how expensive it was for Truecrypt to be audited. That was a small static project. The kernel and systemd are monsters that are constantly changing. Even if you did audit them, a lot of the code would have already changed. I would be disappointed if the NSA hasn't pwned either one by now.
2. Re:Don't cherry pick by rubycodez · 2015-12-29 04:36 · Score: 0
  
  You have links to the code committed by the NSA to Linux kernel? No? Your just blathering about the phobias and fears that only exist between your ears? Yes, we thought so
3. Re:Don't cherry pick by Anonymous Coward · 2015-12-29 04:56 · Score: 0
  
  You have links to the code committed by the NSA to Linux kernel?
  Yeah, because they would totally do that.
4. Re:Don't cherry pick by phantomfive · 2015-12-29 04:58 · Score: 4, Insightful
  
  we have yet to find a way of disabling the keylogger built in to the Kernel. (recorded does not necessarily mean stored long term, but long enough to evaluate in memory.)
  Wait, what exactly does this mean? Even in Linux every keystroke goes through the kernel, it's kind of the purpose of the kernel to handle hardware stuff like that (of course Linux doesn't record it anywhere unless you want it to).
  
  --
  "First they came for the slanderers and i said nothing."
5. Re:Don't cherry pick by kimhanse · 2015-12-29 04:58 · Score: 2
  
  There is a lot of NSA code in Linux.
  http://git.kernel.org/cgit/lin...
  https://www.nsa.gov/research/s...
  I am not saying that it causes the security problems the AC was writing about, but it is there.
6. Re:Don't cherry pick by Anonymous Coward · 2015-12-29 05:02 · Score: 0
  
  Yes, we thought so
  You got a mouse in your pocket? Who is this "we" of which you write?
7. Re:Don't cherry pick by Anonymous Coward · 2015-12-29 05:03 · Score: 0
  
  You have links to the code committed by the NSA to Linux kernel? No? Your just blathering about the phobias and fears that only exist between your ears? Yes, we thought so
  Everything I stated was fact. All I'm saying is that the probability of Linux being compromised by the NSA is not zero. Just like Windows.
8. Re:Don't cherry pick by Anonymous Coward · 2015-12-29 05:06 · Score: 0
  
  It is there, yes. You simply don't have the skill to interpret it, and failing at actually having a talent worth bringing to the discussion, you've just wrapped your tinfoil a little bit tighter for "inspiration."
  You want a bone to pick, try picking one with TOR. A honeypot designed by the feds, every major operation that's been run over TOR has been busted, sometimes with the help of American colleges and universities like Carnegie. Funded, for the most part, by American government dollars...yet you don't see it on the grand list of technologies that X senator is ranting and raving will allow the next attack to occur, do you? I wonder why that might be? Maybe because it's more valuable to give America's enemies a false sense of security to exploit?
9. Re:Don't cherry pick by Anonymous Coward · 2015-12-29 05:15 · Score: 0
  
  You do realize where SELinux actually came from in the first place, right? No, of course you don't, because you're a low ID luser piece of shit who has never learned the fine art of fucking READING.
  https://en.wikipedia.org/wiki/...
  Enlighten yourself while you still have the chance, script kiddie. You never know when someone might take your toys away from you. Not that I could expect much intelligence from somebody who bought onto the Ruby hype train.
10. Re:Don't cherry pick by Anonymous Coward · 2015-12-29 05:32 · Score: 0
  
  Usually the lowid users are the ones who can still read. It's the current crop of millennials who can't read, type, or think worth a damn.
11. Re:Don't cherry pick by rubycodez · 2015-12-29 05:56 · Score: 1
  
  and no one I know uses SELinux because it is bolt-on garbage. I've decades of experience in financial and healthcare systems, there are better ways to do things
12. Re:Don't cherry pick by Anonymous Coward · 2015-12-29 06:15 · Score: 0
  
  Uhmmm, you obviously have no idea about how SELinux works, or what it is good for and you have no friends working on military systems, which is just as well probably.
13. Re:Don't cherry pick by Anonymous Coward · 2015-12-29 06:42 · Score: 0
  
  Ironically the only people that are required to use the "bolt-on garbage" as you put it, is the Federal Government and it's subsidiaries...
14. Re:Don't cherry pick by Anonymous Coward · 2015-12-29 07:49 · Score: 0
  
  TOR is actually a intelligence test sort of like the Lottery is a tax on stupidity. Anyone who believes that most of the exit nodes on any significant TOR type network are not run by or pwned by the at least one government and/or all their out/inbound traffic is monitored by at least one government lacks intelligence. If you want to come to the attention of a government, use TOR and make their job easy by concentrating interesting traffic in fewer places.
15. Re:Don't cherry pick by Anonymous Coward · 2015-12-29 07:53 · Score: 0
  
  Can't tell if sarcastic or sincere...
  If you know someone who has an android phone newer than version 4.4, you know someone who uses selinux.
16. Re:Don't cherry pick by johnw · 2015-12-29 09:17 · Score: 3, Funny
  
  That's not a low ID.
17. Re:Don't cherry pick by Anonymous Coward · 2015-12-29 09:49 · Score: 1
  
  You're engaging in sophistry, making an equivalence between an OS (linux) getting the keystrokes thru its' kernel, and an OS (Win 10) getting the keystrokes & sending them to Microsoft. The purpose of an OS is to process its' user's input, but not to act as a keylogger for a corporation (and possibly the Gov't).
18. Re:Don't cherry pick by Darinbob · 2015-12-29 09:55 · Score: 1
  
  Even on Windows 8 I made sure never to create a Microsoft account, even though it goes out of its way to make it seem like it's mandatory. On OSX I have never created an Apple account either. And for a lot of other services I have to be proactive and disable all cloud services, and periodically check that they weren't turned back on during an update (which Steam did).
  There's a hard drive on the computer, so use it and not the cloud. Duh.
19. Re:Don't cherry pick by pepsikid · 2015-12-29 11:15 · Score: 1
  
  You have links to the code committed by the NSA to Linux kernel? No? Your just blathering about the phobias and fears that only exist between your ears? Yes, we thought so
  Hey Chuckles. You don't know for a FACT that burglars have their sights set on your property. So show us some confidence and leave your doors unlocked and your keys on the dashboard.
20. Re:Don't cherry pick by Cito · 2015-12-29 11:15 · Score: 1
  
  Stephen Smalley at NSA has added code to the Linux kernel.
  http://git.kernel.org/cgit/lin...
21. Re:Don't cherry pick by Anonymous Coward · 2015-12-29 12:06 · Score: 0
  
  Disregard that, I suck cocks!
22. Re:Don't cherry pick by Anonymous Coward · 2015-12-29 12:09 · Score: 1
  
  Except if you read the post, you'd know it's not doing that. They're held long enough to enter the memory state. This is also true in Linux. It's true in BeOS, FreeBSD, OS X, Solaris, AIX, and MINUX.
23. Re:Don't cherry pick by AmiMoJo · 2015-12-29 14:49 · Score: 2
  
  It means most of this stuff is bullshit. For example, Windows 10 only uploads your encryption key if you sign on to a Microsoft account and the machine came encrypted from the factory, in which case the manufacturer had ample opportunity to steal your keys too. This is actually a huge win for privacy, because devices encrypted by default with no effort on the part of the user are clearly better than devices with no encryption.
  If you enable bitlocker manually you can optionally upload your key. For home users who weren't going to encrypt anyway it's a reasonable compromise. If their mobo dies their data will be recoverable via the copy MS keeps for them. For the rest of us it makes no difference.
  The keylogger is pure bullshit. Like other operating systems, you can submit anonymous handwriting samples to improve pen input, but it's optional and doesn't affect most desktop users who don't have pen input. Unfortunately the message that got out was Windows 10 logs every keystroke and sends it to Microsoft.
  
  --
  const int one = 65536; (Silvermoon, Texture.cs)
  SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
24. Re:Don't cherry pick by rubycodez · 2015-12-30 04:49 · Score: 1
  
  false, only certain agencies use it, and some highly secure ones purposely do NOT use it. Hint, there are other OS on this planet than Linux. Hint: your money, for example, is not bits in a Linux system.
25. Re:Don't cherry pick by rubycodez · 2015-12-30 04:51 · Score: 1
  
  they have an unmanaged selinux system set to not be in the way
26. Re: Don't cherry pick by Pozican · 2015-12-30 05:41 · Score: 1
  
  The code audit on true crypt produced less issues than the communities own bug fixes. It seems to me that the results of the audit support the million eyes concept.
27. Re:Don't cherry pick by david_thornley · 2015-12-30 07:38 · Score: 1
  
  The NSA has two missions. One is to spy on communications. The other is to secure US computer and communication systems. I'm not real happy about their balance between conflicting goals.
  
  --
  "When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
28. Re:Don't cherry pick by rthille · 2015-12-30 09:43 · Score: 1
  
  Holy crap. 60k+ is a "low I'd"?
  
  --
  Awesome furniture, accessories and cabinetry in Santa Rosa, CA: http://humanity-home.com/
29. Re:Don't cherry pick by Anonymous Coward · 2015-12-31 06:39 · Score: 0
  
  Put your tinfoil hat on, because the original term describing SELinux, now a standard part of mainline, was "NSALinux".
My favorite version of Windows? by globaljustin · 2015-12-29 04:07 · Score: 2

Yours :P

--
Thank you Dave Raggett
TrueCrypt by duke_cheetah2003 · 2015-12-29 04:12 · Score: 2

Should be noted, TrueCrypt 7.1a (last full version) works fine with Windows 10 if you're really concerned about someone thieving your data. I highly doubt the OS has your TrueCrypt keys if you use this solution, Microsoft account or not.
1. Re:TrueCrypt by Anonymous Coward · 2015-12-29 07:04 · Score: 1
  
  Windows 10 logs all keystrokes, and by default sends everything to MS. Allegedly that transfer can be disabled, but not the logging itself. That info was taken from above.
2. Re:TrueCrypt by cfalcon · 2015-12-29 08:26 · Score: 1
  
  Veracrypt as well. I'm not sure about Ciphershed, but probably. These are the forks of Truecrypt once the Truecrypt devs gave their warnings and went away.
  The keylogger's transmission can be disabled, and I'm not 100% sure if the fact that the data is in the kernel is inherently flawed. It's definitely highly suspicious, however.
3. Re:TrueCrypt by duke_cheetah2003 · 2015-12-29 21:16 · Score: 1
  
  Windows 10 logs all keystrokes, and by default sends everything to MS. Allegedly that transfer can be disabled, but not the logging itself. That info was taken from above.
  That'd be a neat trick, when you're using full system encryption, it logging keystrokes before the OS even starts (which is where you put in your TrueCrypt passphrase.)
4. Re:TrueCrypt by Anonymous Coward · 2015-12-29 23:50 · Score: 0
  
  Veracrypt is a trojan horse.
Re: did we forget the edward snowden stuff already by Anonymous Coward · 2015-12-29 04:15 · Score: 0

Wow, that's some crazy shit you're linking to boss. If you are the author of those websites, no wonder they put you in OSH.
Don't use Microsoft account by sigmabody · 2015-12-29 04:20 · Score: 1

I mean, this should be pretty old news by now, but the moral of the story is the same as the previous N stories where using a Microsoft account uploads your personal information to Microsoft's (and the government's) servers: don't use a Microsoft account. At least this is a relatively easy fix which avoids a lot of the badness of Windows 10. I view it like running an ad blocker: yeah, it's kinda bad for convenience sometimes, but it's a small price to pay to avoid malware I know about, and other malicious things in the future.
Preferable != ideal and wrong conclusions by drolli · 2015-12-29 04:23 · Score: 1

The conclusion in the article was that everybody who manages to hack the MS database or extorts an employee there would get access to my data. While i severely doubt that accessing the key is easily possible for an employee (i would not think so) without being noticed, there is another important point: Whoever steals my key, still needs access to my physical access to the HD (an that is the only situation in which stealing the key makes a difference: physical access, but no possibility to manipulate the OS before).
That would be
(1) thieves
(2) anybody who buys the device witout being wiped correctly
(3) anybody who finde the device after being lost
(4) law enforcement (with court orders)
(5) intelligence service (in the gray zone)
1-3 probably wont get access to the key
4 at least will have to show an official document to MS to get the key (and at least make the transgression trackable, and therefore less likely that some stupid cop "just because he does not like your nose" will search the computer)
IMHO 1-4 are much more likely threats than 5.
Lets go to 5. If you are the target of an attack of any stat-level actor nowadays, i would assume that the level of precaution you have to take goes far beyond "not storing you key at MS". Dont get me wrong, i use local encryption and dont upload the key somewhere.
so the choice is
* making encryption unusable to the everyday user (most likely to get victim of accidental loss/theft) since they are afraid to loose theirs keys (imagine the kind of publicity MS would get....)
* accepting that law-enforcement/state-level actors still can transgress on a few selected users under substantially increased effort, but protect the average user from the fall-out of loosing his/her device
I personally thinks it's absolutely sane to choose the latter (and contrary to the statement in the article, most companies actually *do* store recovery keys centrally for Bitlocker.
If you believe that you are under treat by any western state-level actor, then trust nobody and nothing besides your own brain. The majority of the advice/ideas/hints/analysis which are reported in the tech press in respect to security are worthless shit.
1. Re:Preferable != ideal and wrong conclusions by The-Ixian · 2015-12-29 07:11 · Score: 1
  
  I could not agree with you more.
  The encryption keys are only useful to decrypt your hard drive once your computer has been turned off.
  There are much easier ways for hackers to get your data which do not require decryption at all (because that has already been or is being done once the computer is booted).
  This is a perfectly reasonable trade off in usability without a huge hit to security.
  It is not a "TNO" (trust no one) solution. But if you need that, you probably should not be running anything but a Linux box where you have personally vetted all of the code.
  
  --
  My eyes reflect the stars and a smile lights up my face.
2. Re:Preferable != ideal and wrong conclusions by brix · 2015-12-29 07:34 · Score: 1
  A great analysis. Some points to add:
  
  - I don't think that it's technically required that the attacker have physical access, but it's kind of a moot point otherwise. If the attacker can log in remotely anyway, then they already have access to the unencrypted data because Bitlocker has unlocked the drive at boot time based on the TPM or other protector, right? What full disk encryption does do is protect against those with physical access but not remote access. In other words, the same set of 1-3, and probably 4.
  - Agreed on (5). I seem to remember seeing a quote from someone in security circles that said something like, "I typically assume that at least two countries have access to my system at any given point in time." In other words, you are already vulnerable; deal with it. Granted, this provides an additional attack vector, but as you said, it's the same for most corporations running Bitlocker with AD. The threat is no greater with MS storing the key, and probably much lower than your typical IT department.
I knew it! by MagickalMyst · 2015-12-29 04:41 · Score: 1

Microsoft doesn't give anything away for free without a catch.

In this instance, the catch is your encryption key.

--
Political correctness is really just herd psychology pushed by insecure people who desperately seek social conformity.
Re: If privacy is a concern, you don't use Windows by IBME · 2015-12-29 04:55 · Score: 1

Tbqh, I have entertained the idea of running windows offline for quite some time now. I run a windows 7 pro desktop and a windows 7 pro tablet. On both I use Bleachbit, PrivaZer, & run Yamicsofts Windows7 Mgr, using Tinywall as a windows fw gui. Yamicsoft allows you to see the tasks created that send data back and/or the one that silently sets you up for an unwanted OS update. I delete them all. As for encryption, gpg4win or the like is useful to me. Full disk is not necessary atm and in fact the only thing I encrypt is obviously my password manager. I will be investing in a couple of Yubikeys before spring to get two factor up and running system wide, incl. for my phone. Windows 10 is too full of holes, driver and or sound problems, and clearly cannot be trusted. As well, unless they can claim it is significantly faster than 7, which it isn't, It is absolutely useless to me unfortunately.
Bitlocker and BIOS/UEFI.... by Anonymous Coward · 2015-12-29 05:00 · Score: 0

Well the poor saps that enable bitlocker and then update the BIOS...
If you don't have the key, i.e. your a home user and rush thru setup screens clicking OK, OK, OK, OK, OK, OK, OK, OK, OK, OK, OK and OK!
Well your screwed and get to revert back to the factory state of 8.1 and re-install your apps! This was huge fun for a customer using a Dell XPS 13 9q33 tablet thingy that they all hate.
I love Microsoft's direction!
This is why.. by Anonymous Coward · 2015-12-29 05:12 · Score: 0

I switched back to Linux. At one point in time I actually enjoyed using Windows 7. Tested Windows 8, and 8.1, and was not happy with how the functionality of each began to feel like Windows ME all over again. For gaming purposes I enjoyed using Windows 10 up until Microsoft wanted to dig a little too deep into what I do on my machine.
If Microsoft would consider allowing users to restrict this kind of access for more private, and be more transparent; I'd consider going back to Windows for PC gaming.
Read the fucking EULA by Anonymous Coward · 2015-12-29 05:25 · Score: 0

Read the fucking EULA; it's in there.
Change OS by jraff2 · 2015-12-29 05:41 · Score: 0

Christmas was good to me. I got an HP Envy computer with Windows 10. I turned it on, but didn't let it on the network, because I knew it would report. I built a linux stick and booted the cheap but safe OS, leaving Wanders on the disk but untouchable.
The acknowledgement does not look good by 140Mandak262Jamuna · 2015-12-29 06:03 · Score: 2

Not only you have to upload your recovery key to microsoft, the response you get after you upload from their servers does not bode well.
It says "all your base are belong to us".

--
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
HIPPA Compliance by ITRambo · 2015-12-29 06:33 · Score: 2

Does MS having a copy of a WIndows 10 Pro bitlocker key for a PC in a small medical office violate HIPPA or is the issue moot?
1. Re:HIPPA Compliance by cfalcon · 2015-12-29 09:13 · Score: 1
  
  I don't think you can use Windows 10 in that setting at all yet.
2. Re: HIPPA Compliance by Anonymous Coward · 2015-12-29 13:42 · Score: 0
  
  It doesn't really seem like you understand encryption, keys, OR HIPPA.
3. Re:HIPPA Compliance by Anonymous Coward · 2015-12-29 16:04 · Score: 0
  
  It's a moot point. The recovery keys are useful only for that purpose..recovery..with access to the physical device. The recovery keys are not useful in a remote attack and MS does not have the authority to seize your computer and share your patient's info. Disk encryption does not protect against online attacks anyway because the disk data is decrypted while the OS is running. Disk encryption protects against device theft (or seizure by law enforcement if you have those kind of secrets).
You're a sucker if you have Windows 10 by kheldan · 2015-12-29 07:08 · Score: 0, Flamebait

Plain and simple. You may as well be parading around in public wearing a T-shirt with all your most private information printed on it front and back, along with a link to a filesharing service download for all your other data. Given the choice between Windows 10 and no computer at all, I'd rather have no computer.

--
Are YOU using the TOOL, or is the TOOL using YOU? Think about it!
What key? by Anonymous Coward · 2015-12-29 07:45 · Score: 0

Wait which key is this? My personal key or the backdoor key we all know Microsoft made for the NSA?
Even domain connected machines by Anonymous Coward · 2015-12-29 07:55 · Score: 0

I had been enjoying my domain-connected Win10 machine, even riding out the changes in defaults with each major build update. But when I discovered that the photo app had been exploring my domain looking for images and presented me with a couple of folders 'look what I just did, dad...' it was hard not to freak. This is still my copyrighted material and the idea that an application that I do not use had fired up on its own and trolled through my off-machine files was a bit hard to digest. The old picture viewer is gone, so if I want to view a couple of jpgs on a cd I need to sign onto the photo app and then, maybe, it will let me look... A relative keeps finding Edge opening up websites on his machine... guess MS wants to make sure we know who is boss. Too bad, I really liked it. But finding out that the pretty face masked a burglar riffling my drawers was a bit much.
Microsoft has your win10 Encryption Key by shubus · 2015-12-29 07:58 · Score: 1

Absolutely NO ONE can be surprised by this. Anyone think NSA wasn't in this up their eyeballs?
Does this include dev accounts by fredrated · 2015-12-29 08:10 · Score: 1

like Microsoft developers forums?
"Typical American stupidity." by Anonymous Coward · 2015-12-29 08:43 · Score: 0

European hypocrite.
Headline is a *tad* FUDdy, but article is accurate by cfalcon · 2015-12-29 08:58 · Score: 2

Bitlocker lets you have the option to save your "recovery key" to USB, or to print it. In both cases, you can destroy the key effectively (note that you'll have to take care to ensure that the USB device is physically destroyed or secured in a manner secure against attackers you are concerned about, and that your printer doesn't keep a recoverable copy somewhere).
So Bitlocker is (in theory) safe and secure. Personally, I wouldn't trust this- it's proprietary, it's Microsoft, and there's every motivation to either make the key recoverable or disclose it for uses Microsoft deems useful (for instance, a future tyrannical government might be able to threaten them in such a way as to produce the keys). But by their claims, it should be.
The article distinguishes this from "device encryption", a gimped form of Bitlocker present in the "Home" edition that they give for free (or cheap or whatever- once I did even the first amount of research into Windows 10 I decided to avoid it entirely). If you pay for Professional, you get access to "Bitlocker", which has configuration options, including the print-out and USB options, which can result in NO recovery key- the generally desired state from a security perspective.
The headline of the article truthfully states that Microsoft "probably" has your recovery key, and the slashdot headline leaves that out totally. Both leave out the important fact that you have to be using the "device encryption" version of Bitlocker in the shit-tier version of Windows 10.
There's other posts talking about the keylogger, or kernel keylogging. I'm not sure the fact that the kernel keeps your keystrokes for awhile is inherently vulnerable, but it is suspicious.
In any event, the fact that you must be an expert user to get anything that MIGHT be security out of Windows 10 is absolutely disgusting. The Home version will be the most common by far, and the average user will not be aware of the default settings where keys are sent (along with a ton of other things) upstream, nor will he be aware of the fact that his supposed device encryption is recoverable by any hacker or bad actor in the future. The level of drama required to do anything in Windows 10 is massive. It's a real nightmare.
Anyone notice how oddly hard it is to set up anything but straight AES in almost all places? There's a shocking lack of user exposed options even in Linux (and Linux can be configured to extremely high levels of redundancy or security). Name a distro that lets you full disk encrypt with AES-Twofish-Serpent from a GUI, for instance (again, you can absolutely configure this, but it seems hard to get anything but straight AES). I know AES is trusted, but I'd trust it more if there were ways more ways to opt out of it and use either another block cipher, or it WITH another block cipher.
Even more reason by DaMattster · 2015-12-29 09:01 · Score: 1

To not use Microsoft's products!
I just installed Linux Mint 17.3 by Anonymous Coward · 2015-12-29 09:52 · Score: 0

I like it better and it took less time to install. My Mighty Mouse works better.
And less hassle than my Hackintosh that my battery never got to work.
It is shaping up to be real nice. By the time it is out of Beta sweetness all around.
I used Microsoft sense Dos 1.1 and never complained about any 95 98 2000 Vista But they refuse to do anything that helps me only them.
Their partition tool in 10 could not delete a EFI partition from OSX had to use a third party tool.
I wanted to partition non destructively with the Windows 10 tool lost everything. Install Linux mint it does it instantly.
I would be ashamed to say I worked on Windows.
So when does linux get this via SystemD and co? by Anonymous Coward · 2015-12-29 10:55 · Score: 0

So when does linux get this via SystemD and co?
Or is it allready a feature of Intel AMT/VPro
(yes, complete ram upload...)
Is anyone stupid enough by Anonymous Coward · 2015-12-29 11:31 · Score: 0

not to know microsoft has been forced to hand over keys to the NSA?
Your keys are saved by the NSA, maybe the CIA, etc.
BS by s.petry · 2015-12-29 12:40 · Score: 1

You are attempting to conflate a kernel passing device information, with a kernel capturing and analyzing that information. It is not the same thing, and I think people should be insulted reading posts like yours.

--
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
1. Re:BS by phantomfive · 2015-12-29 13:20 · Score: 1
  
  You are attempting to conflate
  I'm not trying to conflate anything lol. I was asking a clarifying question to understand what you were saying, then you got defensive.
  
  --
  "First they came for the slanderers and i said nothing."
2. Re:BS by Anonymous Coward · 2015-12-30 02:59 · Score: 0
  
  He's got a lot of his manhood and professional competence invested in the Windows 10 keylogger's existence. I mean, he is a Senior System Engineer/Architect, after all.
More BS by s.petry · 2015-12-29 12:42 · Score: 1

If you read the post you will see that the memory is still evaluated for particulars which ANY application could grab if it knew the correct system calls. Pass through is NOT what Windows 10 is doing.

--
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
Re: did we forget the edward snowden stuff already by Anonymous Coward · 2015-12-29 13:30 · Score: 0

I'm actually totally fine with the NSA being able to take and read our physical devices. It's mass surveillance over the wire that is bullshit.
True since Windows 8 by fearofdecaf · 2015-12-29 13:48 · Score: 1

This has been the case since Windows 8 if you used BitLocker while logging into your PC using a Microsoft Account. It's not one of the newly deployed 'features' either, I looked into it when I was going to purchase a Surface Pro 2 a couple of years ago. The simplest solution is to log in with a local account.
http://windows.microsoft.com/e...
See "How can I get my BitLocker recovery key".
Money by Anonymous Coward · 2015-12-29 15:18 · Score: 0

How else are they going to charge you to reset your password
Recovery Key Encryption? by Cardcaptor_RLH85 · 2015-12-29 18:19 · Score: 1

My question here is, is the recovery key at least encrypted (by whatever method) with your account password on their servers or is it in the clear to MS? If the latter is true, then that's another reason to use some other method of system encryption. If the former then, yes, it's somewhat troubling that this can't be disabled prior to uploading the key but, it's really not the worst problem.
Does it really matter? (Obligatory XKCD) by rocket+rancher · 2015-12-30 00:43 · Score: 1

Does it really matter where your key is stored? I think not.
What is this? by RockDoctor · 2015-12-30 16:17 · Score: 1

... Windows 10 thing?
I continue to get spam from an Indian company about it, but, why should I care about their new viruses?

--
Birds are not dinosaur descendants;birds are dinosaurs, for all useful meanings of "birds", "are" and "dinosaurs"
Don't believe ANYONE ! by Anonymous Coward · 2015-12-31 13:06 · Score: 0

When all is said and done, SOMEONE ELSE has your backdoor key. They will deny it. Adjust to that idea. The rest is part of a bigger picture you probably be better off not knowing anyway.