"Naive" doesn't sit right with me. Anyone can scrutinize LUKS, or BitLocker for that matter (via cryptsetup). Backdoors aren't the issue here, even for MS Bitlocker. The issue, as stated in the article, is:

by default, BitLocker recovery keys are uploaded to Microsoft’s cloud

No need for a backdoor if you know you can get keys to the front door.

This is not a backdoor

This is the house rental company having a key to the front door

To use Windows without a Microsoft account requires tech literacy these days, I thought. I would not be suprised if users didn't choose to sync with a MS account but it's doing it anyway, if that's what MS want.

It's a bit harsh and unfair to say "you are dumb enough to allow it". Microsoft makes it damn near impossible to avoid this unless you are extremely particular and savvy about it, and never have an off day where you make a mistake while using your PC.

Encryption doesn't actually complete until you log in with a Microsoft account for Home Edition.

Anyways: Use Veracrypt.

Or just Linux + LUKS

But, by default, BitLocker recovery keys are uploaded to Microsoft’s cloud, allowing the tech giant — and by extension law enforcement — to access them and use them to decrypt drives encrypted with BitLocker, as with the case reported by Forbes.

I mean it's dumb to sync but at same time it's not like MS isn't great at either making it almost impossible to not sync it re-enable syncing for a bit after updates.

You can constantly tell it not to sync but all it takes is MS saying we want it now and they'll get it

Are you naive enough to believe the surveillance OS that uploads literally all of your activity along with screenshots of your desktop doesn't automatically upload you keys no matter what little box you tick on the installer?? 😂 there is absolutely not one single 3rd party auditing that they actually follow any of the options at all that they give.

Save a copy of your bitlocker keys to a Veracrypt drive with a password no shorter then 15 mixed characters. Then upload that encrypted container to any free service. They wont be able to open it and now you have a remote backup copy.

They do have a copy of your Bitlocker key if you are dumb enough to allow it to sync with your Microsoft account, you know, “for convenience.”

Which I don't believe is the only way it can leak. It's well known Microsoft can access anything and everything on an internet connected Windows PC whether there's a Microsoft account or not. If the nazi's push for the device of someone on a local account only, you know they'll magically find a way.

i heard win11 its automatically used online for home.

Why is that dumb?

I encrypt my drive to protect my data from burglars and thieves who might steal my laptop, how would they obtain the recovery key from Microsoft? O_o

Except that Microsoft basically puts a gun to every users head to login with a Microsoft account which can/does backup the recovery keys.

If you sign into a Microsoft account during setup, Microsoft automatically turns on bitlocker and sends the key off to Microsoft for safe keeping. You are right, there are other ways to handle bitlocker, but that's way beyond most people, and I don't think Microsoft even tells you this during setup. It's honestly a lifesaver for when bitlocker breaks(and it does), but it comes at a cost. In the business world, this is seen as a huge benefit, as we aren't trying to protect from the US government, mostly petty theft and maybe some corporate espionage.

As is often the case, the real solution is Linux, but that, too, is far beyond most people until manufacturers start shipping Linux machines to big box stores and even then they'd probably not enable any encryption.

You're assuming there isn't a master pubkey baked into the software.

As long as you're doing your own whole disk encryption, you have a valid path to still be secure. However, if you're running an unencrypted disk, you're much more likely to lose your data to a non-state actor.

Well this isn't directly related to those, so maybe some derision is warranted.

Both are completely unrelated to the discussion. TPM sometimes have issues regarding their security, but you can certainly use Secure Boot with your own signing keys to ensure the kernel you run is one you installed, which improves security. And you can use TPM to either keep your FDE keys, or only part of them combined with a PIN if you don't fully trust them to be secure, so you keep strong encryption but with a bit of convenience.

Without a (properly configured) Secure Boot startup, anyone could just put a malware between the actual boot and your first kernel. If the first thing that happens when you boot is something asking for a password to be able to decrypt your storage, then an attacker can just put something here, grab your password, and let you proceed while storing in a a place it can be retrieved.

Is this scenario a concern for most people? That's unlikely. But every computer sold these last five years (at least!) can be setup to reduce this risk, so why not take advantage of it.

Not even from the company that tried to provide you with windows recall? 🤣

Don't be silly, the dog uses Puppy Linux.

btw……

That doesn't make it the same thing

Small correction. They were not exonerated. They were pardoned. A pardon implicitly means guilt. Exonerated means their conviction was overturned.