2

I have a Windows 10 Pro machine; the administrator (and only) account is a Microsoft account. I am trying to set up BitLocker to ensure maximum security and safety, even from Microsoft.

I understand that I can choose to disallow BitLocker from saving the recovery key to my Microsoft account.

However, does this option matter at all if my user account is a connected Microsoft account anyway? Microsoft already has my user account password. Couldn't Microsoft just use the actual password (which it has) to decrypt the data (given access to the physical drive) instead of the recovery key?

schroeder
  • 123,438
  • 55
  • 284
  • 319
Daniel
  • 151
  • 1
  • 6

2 Answers2

2

BitLocker is technology to encrypt the disk drive pror ANY software, including OS, try to access it. Your Microsoft account acts on OS level as user credentials and in practice there could be more than one registered user account on one PC. Which automatically make nonsense to mix the encryption key with the user accout. Moreover, normal account password length is between 8 and 12 characters, when BitLocker key is much longer and complex. Finally, but not last, Microsoft provide additional methods of managing BitLocker key in corporate environment through ActiveDirectory, which is a level above your private home usage.

Тони Гарабедян
  • 21
  • 2
0

Yes that option matters. It allows you to save your key locally. Which I recommend doing rather than putting it in the cloud.

MGoBlue93
  • 185
  • 7
  • Thank you for your reply. Unfortunately, this does not answer my question completely. I see the value in the option apart from a connected Microsoft user account. – Daniel Jan 31 '19 at 06:16
  • I'm confused... let's step back for a second. When one configures bitlocker, they have the option to (more or less, without being pedantic) store the key remotely or locally. If you select the Microsoft Account option, it's going to put it in your OneDrive account. The bitlocker key and the password to OneDrive are not the same (re: "Couldn't Microsoft just use the actual password"). If you select the save to file option, you can put the key on a USB drive and then protect that drive accordingly. – MGoBlue93 Jan 31 '19 at 16:30
  • I understand the rationale for storing the key locally. However, my assumption is that the BitLocker encryption key and the user-account password are related to each other. So, if Microsoft has my user-account password (because it’s a connected Microsoft account), I’m imagining that they could use this information to somehow unlock the BitLocker encryption key and decrypt my files, given access to the physical drive. Obviously, this wouldn’t be a concern with a local non-Microsoft-connected user account. – Daniel Jan 31 '19 at 20:39
  • I'm confused. Is your OneDrive password related to your BitLocker key? They are not. – MGoBlue93 Feb 01 '19 at 22:47
  • Ok, thank you for this clarification. I am surprised, but perhaps I shouldn’t be. I understand you to mean that if party x possessed a drive with encrypted data on it and party x also possessed the user account password used by a Windows 10 account on that drive to encrypt the data on the drive, party x could not somehow use the user account password to derive the encryption key and decrypt the data on the drive. Is this correct? – Daniel Feb 03 '19 at 04:26
  • I'm really super confused by the last comment... my apologies. My participation in this thread has been to clarify that a bitlocker key and a onedrive account are not related. When you say "I am surprised, but perhaps I shouldn't be"... I would ask, "Why? Why would you be surprised?" Would you consider an apple to be equal to an orange simply because they are fruit? Of course not. Don't do that with bitlocker and onedrive then. bitlocker and onedrive both have an authentication mechanism but that's where any comparisons should end (continued) – MGoBlue93 Feb 06 '19 at 00:52
  • (from continued) Besides, this is an infosec forum -- put your thinking cap on for a moment; do you really think it's a secure solution if Microsoft designed something where if your cloud account got hacked then your hard drive encryption became compromised as well? Of course not. People would be losing their minds over that poor of a design. Rightfully so. – MGoBlue93 Feb 06 '19 at 00:55
  • 1
    @MGoBlue93 I think OP's confusion is around the fact that logging-in to their PC's account (which is linked to a Microsoft account) will give the OP access to the hard-drive. The OP's fear / assumption seems to be that because of that link, Microsoft – if in possession of the hard-drive – would be able to login using the Microsoft account and also gain access (irrespective of where the recovery key was stored). [**cont**] – TripeHound Oct 28 '19 at 09:40
  • 1
    [**cont**] _My_ assumption / guess / hope is that would only be possible if you knew the appropriate password (to the PC-account and/or the Microsoft account), and that Microsoft do _not_ know the password. Therefore, they _wouldn't_ be able to access the hard-drive, and that @Daniel's fears are unwarranted (but I don't know enough about Microsoft accounts to be certain...) – TripeHound Oct 28 '19 at 09:42