Hacker News Reader

Comment by parl_match | Hacker News Reader

Because "gave" implies a favor or a one sided exchange. It implies that Microsoft is just giving away keys for no reason!

Better, and more accurate wording, would be that "Microsoft surrendered keys" or "Microsoft ceded keys". Or "Microsoft legally compelled to give the keys". If Microsoft did so without a warrant, then "gave" would be more tonally accurate.

In addition, none of this is new. They've been turning over keys when legally compelled to, for many years.

Fun fact: Apple does this too. https://support.apple.com/en-us/108756

View on HN

In fairness, the link is specifically for "Advanced Dat Protection for iCloud". This has nothing to do with local whole-disk encryption like FileVault or BitLocker.

In Apple's case, even when the user enables iCloud FileVault key backup, that key is still end-to-end encrypted and Apple cannot access it. As a matter of fact, while Apple regularly receives legal warrants for access, they are ineffective because Apple has no way to fulfill that request/requirement.

Microsoft has chosen to store the BitLocker key backups in a manner that maintains their (Microsoft's) access. But, this is a choice Microsoft has made its not an intrinsic requirement of a key escrow system. And in the end, it enables law enforcement to compel them to turn over these keys when a judge issues a warrant.

> This has nothing to do with local whole-disk encryption like FileVault or BitLocker.

Wrong. When you set up a Mac laptop, it gives you the option to escrow keys. ADP disables that and ADP also prevents key escrow for iDevice backups.

This is changed in Tahoe, but that's a really important callout that you need to make (and that you aren't making)

> In Apple's case, even when the user enables iCloud FileVault key backup, that key is still end-to-end encrypted and Apple cannot access it.

This is not true for older but relevant versions of macos. It was changed in Tahoe.

With ADP enabled (which the vast majority of users do not have), this is completely incorrect. This is still factually wrong, and dangerously misleading.

The fact that none of this is new undermines your point. Microsoft knew that law enforcement would ask for keys, based on their prior experience and the sack of meat sitting between their ears.

They, knowing that, chose to design a system that trivially allows this. That is a choice. In that sense, they did give up the keys. They certainly did not have to design it that way, nor was it done in ignorance.

Apple did this too, though. So did Google.

Actually, Apple changed this in Tahoe but it's still a decade plus of this exposure and knowledge of this exposure.

Reply on news.ycombinator.com