- The headline is misleading. It says that Microsoft will provide the key if asked, but the linked statement to Forbes says Microsoft will provide the key if it receives a valid legal order.
These have different meanings. Microsoft is legally entitled to refuse a request from law enforcement, and subject to criminal penalties if it refuses a valid legal order.
It does illustrate a significant vulnerability in that Microsoft has access to user keys by default. The public cannot be sure that Microsoft employees or criminals are unable to access those keys.
by cornholio
11 subcomments
- Beyond the crypto architecture debate, I don't really understand how could anyone imagine a world where MS could just refuse such a request. How exactly would we draft laws to this effect, "the authorities can subpoena for any piece of evidence, except when complying to such a request might break the contractual obligations of a third party towards the suspect"?
Do we really, really, fully understand the implications of allowing for private contracts that can trump criminal law?
- Actual freedom starts with freedom of thought which requires spaces that you can truly believe are safe. The push for the surveillance world is rapidly eroding the places someone can not only be safe to think but feel safe to think in. The 'feel safe' is deeply important here. The arguments of 'if you have nothing to hide' do not make anyone feel safe, they do the opposite and they chill free thought.
The second, very clear, argument is that the state can't be trusted in the long run. Period. Maybe you love your elected officials today but tomorrow they could be actively out to harm you. Every tool we allow the state to use needs to be viewed with this level of extreme skepticism and even very clear benefits need to be debated vigorously.
Encryption, and technologies like it, may allow hiding criminal activity but they also provide people a sense of security to think freely and stave off political power grabs. We recognize the fundamental right to free speech and give great latitude to it even when it is harmful and hateful, we need to recognize the fundamental right to free thought and recognize that encryption and similar tools are critical to it.
by pregnenolone
2 subcomments
- I’m not trying to defend Microsoft, but I think people are being a bit dramatic. It's a fairly reasonable default setting for average users who simply want their data protected from theft. On the other hand, users should be able to opt out from the outset, and above all, without having to fiddle with the manage-bde CLI or group policy settings.
With Intel Panther Lake (I'm not sure about AMD), Bitlocker will be entirely hardware-accelerated using dedicated SoC engines – which is a huge improvement and addresses many commonly known Full Disk Encryption vulnerabilities. However, in my opinion some changes still need to be made, particularly for machines without hardware acceleration support:
- Let users opt out of storing recovery keys online during setup.
- Let users choose between TPM or password based FDE during setup and let them switch between those options without forcing them to deal with group policies and the CLI.
- Change the KDF to a memory-hard KDF - this is important for both password and PIN protected FDE. It's 2026 - we shouldn't be spamming SHA256 anymore.
- Remove the 20 char limit from PIN protectors and make them alphanumerical by default. Windows 11 requires TPM 2.0 anyway so there's no point in enforcing a 20 char limit.
- Enable TPM parameter encryption for the same reasons outlined above.
by notepad0x90
1 subcomments
- I don't understand this, it's actually baffling. Why was the question being asked to begin with let along a whole post being made about this? If they have a legal request from a law enforcement agency of any country they operate in, they either comply or see executives in prison.
Is how bitlocker works not well known perhaps? I don't think it's a secret. The whole schtick is that you get to manage windows computers in a corporate fleet remotely, that includes being able to lock-out or unlock volumes. The only other way to do that would be for the person using the device to store the keys somewhere locally, but the whole point is you don't trust the people using the computers, they're employees. If they get fired, or if they lose the laptop, them being the only people who can unlock the bitlocker volume is a very bad situation. Even that aside, the logistics of people switching laptops, help desk getting a laptop and needing to access the volume and similar scenarios have to be addressed. Nothing about this and how bitlocker works is new.
Even in the safer political climates of pre-2025, you're still looking at prosecution if you resist a lawful order. You can fight gag-orders, or the legality of a request, but without a court order to countermand the feds request, you have to comply.
Microsoft would do the same in China, Europe, middle east,etc.. the FBI isn't special.
- If you are not typing in a passphrase or plugging in a device containing a key to unlock your disk then the secret exists somewhere else. Chances are that secret is available to others. The root issue here is that the user is not being made clearly aware of where the secret is stored and what third party(s) have access to it or reasonably might be able to get access to it.
These sorts of things should be very unsurprising to the people who depend on them...
by caseysoftware
1 subcomments
- Due to Third Party Doctrine, Microsoft doesn't even NEED a "legal order." It's merely a courtesy which they could change at any time.
Based on the sheer number of third parties we're required to use for our day to day lives, that is ridiculous and Third Party Doctrine should be eliminated.
Ref: https://en.wikipedia.org/wiki/Third-party_doctrine
- Headline says “…if asked”
Article and facts are “…if served with a valid legal order compelling it”
∴ Headline is clickbait.
- Veracrypt
https://veracrypt.io/en/Home.html
by ntoskrnl_exe
2 subcomments
- Pretty sure the same applies to all the passwords/passkeys/2FA codes stored in the Authenticator app with cloud backup on.
by pedalpete
2 subcomments
- Controversial question here.
When someone is arrested, the police can get a subpoena to enter your house, right?
There they can collect evidence regarding the case.
Digital protections should exist, but should they exist beyond what is available in the physical world? If so, why?
I think the wording of this is far too lenient and I understand the controversy of "if asked" vs "valid legal order", neither of which strictly say "subpoena", and of course, the controversy of how laws are interpreted/ignored in one country in particularly (yes, I'm looking at you USA).
Should there be a middle ground? Or should we always consider anything that is digital off-limits?
- Related discussion from yesterday: https://news.ycombinator.com/item?id=46735545
by davidguetta
2 subcomments
- Lol it's been 20 years now that the whole world should stop to be all surprised pikachu about that.
- If tech companies implemented real, e2e encryption for all user data, there would be a huge outcry, as the most notable effect would be lots of people losing access to their data irrevocably.
I'm all for criticizing tech companies but it's pointless to demand the impossible.
by chrisss395
0 subcomment
- My wife is an insurance litigation attorney and regularly requests social media data from Microsoft, Meta, etc. for people. Generally they hand it over without issue; I think Apple is the only one to have pushed back at times.
- Any reason to believe Apple won't do the same with whatever we backup in iCloud?
- > ... if asked
This is blurring of fact drives click bait.
The origin of this is a Forbes article[0] where the quote is: "Microsoft confirmed to Forbes that it does provide BitLocker recovery keys if it receives a valid legal order."
[0] https://www.forbes.com/sites/thomasbrewster/2026/01/22/micro...
by shevy-java
0 subcomment
- Not surprising. The whole Win11 feels like a spy-tool for the government. Just that "recall" anti-feature nobody needs - except for those who want to sniff and spy after people.
by anonymousiam
0 subcomment
- It's already established that your disk encryption keys are in the Microsoft cloud whether you want them there or not. It's just a small step from there to your local government having the key too. Some governments claim to respect the privacy of their citizens, but there are always exceptions. Most governments likely have direct access to the keys, and don't even need to make the request.
by commandersaki
0 subcomment
- This is no different to Apple placing the encryption key for Filevault as plaintext on disk when it is turned off (the default). Both companies make it easy for you to recover data in event of a catastrophe.
by nickevante
0 subcomment
- The headline is slightly misleading. Microsoft can only provide the key if you are using a Microsoft Account which automatically escrows the BitLocker recovery key to OneDrive.
If you use a Local Account (which requires bypassing the OOBE internet check during setup) or explicitly disable key backup, the key never leaves the TPM. The issue isn't the encryption algorithm its the convenience selection.
- At least they’re honest.
- This issue aside, if anyone has the keys what value are they in the end? Has Microsoft ever refused to unlock someone's pc stating that they could not technically do that? Isn't storing keys like this akin to storing passwords in clear text?
by politelemon
3 subcomments
- The major OS vendors (apple, google, ms) are complicit in data turnover and have been for over ten years now. It has been reported multiple times so I'm struggling to see the angle being projected here. This feels like click harvesting got the HN "Microsoft bad" crowd.
- If you potentially are a target for the us government you should avoid Microsoft.
Given that the us government is happy to execute us citizens and invade other countries that basically means everyone.
- No surprises here. There are people out there warning this would happen soon or later, and urging people to stop using Microsoft products, but of course, nobody cared about it as usual.
- I do find it quite interesting how people support this idea (because they got a warrant), but are vehemently against the idea of backdooring encryption.
How is this any different?
- Stallman was correct
- Does Microsoft let you encrypt the key with your password / passphrase (with a backup you can write down)?
by b00ty4breakfast
0 subcomment
- it is perhaps mildly surprising that they have access to user encryption keys, but anyone surprised, over 20 years post-Patriot Act, that an American corporation is willing to cooperate with American federal law enforcement has maybe not been paying attention.
by dist-epoch
0 subcomment
- Everybody should have access to your hard drive, not just the FBI, so please do not encrypt your hard-drive.
If you encrypt your drive and upload the key to Microsoft, you are engaging in anti-competitive behavior since you give them access to your data, but not also to the local thief.
Just don't encrypt your drive if you cant be bothered to secure your key. Encryption-neutrality.
by banku_brougham
0 subcomment
- whenever someone mentions the FBI I think of of a picture of the current highly incompetent and malevolent director.
by Timothycquinn
0 subcomment
- Time to use Linux as the on the metal OS.
- Damn I love my dear little tux.
- shocking
by ChrisArchitect
0 subcomment
- [dupe] Discussion on source: https://news.ycombinator.com/item?id=46731694
And earlier: https://news.ycombinator.com/item?id=46735545
by seanhunter
0 subcomment
- “American company will comply with American law”. I’m shocked. Shocked I tell you!
- If I remember well from installing Windows you can store the keys yourself without a cloud backup. What am I missing?
- Why Microsoft stores the encryption keys of the users in their servers? Key recovery is convenient, but in my opinion it should exist the "opt out" option, without MS being involved in the key storage in their datacenters.
- Because yours Windows PC isn't yours
by TheRealPomax
0 subcomment
- Title should read "Microsoft confirms it will give the FBI your Windows PC data encryption key if court-ordered to do so".
Just because the article is click bait doesn't mean the HN entry needs to be, too.
Sure, the fact that MS has your keys at all is no less problematic for it, but the article clearly explains that MS will do this if legally ordered to do so. Not "when the FBI asks for it".
Which is how things work: when the courts order you to do something, you either do that thing, or you are yourself violating the law.
by TheRealPomax
0 subcomment
- What's that? Windows, due to its market position, should not be allowed to force users into online-only accounts? Agreed.
by bdhcuidbebe
0 subcomment
- But, the pile of reasons for not running windows is already through the roof…
by cynicalsecurity
0 subcomment
- VeraCrypt.
- The problem is not that they will give the key (government can force them - this is expected), but that they even have the key in the first place.. I bet this is done without proper consent, or with choice like "yes" vs "maybe later"..
- Apple will do this too. Your laptop encryption key is stored in your keychain (without telliing you!). All is needed is a warrant for your iCloud account and they also have access to your laptop.
sixcolors.com/post/2025/09/filevault-on-macos-tahoe-no-longer-uses-icloud-to-store-its-recovery-key/
by jonplackett
1 subcomments
- He headline misleading - they will give it if there’s a court order, not just if asked.
Still crap but the headline is intentionally inaccurate for clickbaiting
- "US firm confirms it will comply with US law if asked."
- Very different phrasing between the headline and the subtitle:
> Microsoft confirms it will give the FBI your Windows PC data encryption key if asked
> Microsoft says it will hand those over to the FBI if requested via legal order
Microsoft complying with legal orders is not news. But why hire actual journalists when you can just lie in your headlines and still get clicks?
by expedition32
0 subcomment
- Honestly I have no problem with this but I do remember a lot of gaslighting about how America is free and Europe a totalitarian state.
- not your keys? not your crypto
- Which is really galling when you consider how many Windows 11 users have inadvertently been locked out of their own bought-and-paid-for computers thanks to BitLocker.
- Local company complies with the law. In other news, the sky is blue...
by junglistguy
0 subcomment
- [dead]
- [dead]
by throwconsti
0 subcomment
- MS confirms it has to comply with warrants to the consternation of many.
by SketchySeaBeast
1 subcomments
- Duplicate story. Previous discussion here.
https://news.ycombinator.com/item?id=46735545
Edit: Nevermind.
by lovebeans
3 subcomments
- Yes and this is a good thing. No organization, no matter how large or powerful, should be beyond the reach of the law.
Hacker News