Microsoft Gave FBI Keys To Unlock Encrypted Data, Exposing Major Privacy Flaw

They don’t want you to be able to use encryption they can’t control.

"Not every 'WTF micro$oft' moment is a slam dunk," he tweeted. "I've emailed VeraCrypt personally and we'll get him unblocked. I've already talked to Jason at WireGuard. Not everything is a conspiracy, sometimes it's literally paperwork."

Funny how paperwork never really seems to be a problem for any other OS.

Wow, that’s pretty damming. Three of them? This can’t be a random absurd error like it plausibly could have been for the first one reported.

There must be a really big flaw in their system if three VPN devs just “missed an email”. Is Microsoft sending the emails from a bullshit sus address?

Introduce mandatory signatures for driver files, they said. It's so safe, it's for your protection against viruses - they said. Keys can always be revoked from unscrupulous developers - they said. It will never be used to fight opensource, they said. It will never be a tool against inconvenient CIA applications - they said.

Microslop doing microslop things.

Glad I got out when I did.

I'm happy with Linux Mint, and most Windows users would be too, methinks.

My guess?

NSA is currently figuring out how to insert backdoors into all these things.

You see, the last backdoor they used all the time, well.... people figured it out.

So, they had to ban uh, checks notes, apparently all routers, basically.

So, now they need a new backdoor into literally everything.

I'd like to believe that this means that these three pieces of software actually work and that someone in high office has decided that that is unacceptable.

Paranoid authoritarians really do not like ordinary people having access to secure communications and personal privacy. That might be an avenue they can use to organise and elect someone who isn't a paranoid authoritarian, and that won't do.

On the other hand, these pieces of software might already be compromised and this is all an elaborate double-bluff.

In which case it's time for a few well placed communications over purportedly secure channels that would be guaranteed to generate an authoritarian response. Which they'll then have to pretend they didn't read until it's too late.

I'm talking organising - horrors - peaceful protests. They really don't like those. They have to use their brains, or someone else's, in order to find a good excuse to stick the boot in.

How many more of these do people really need to just get the fuck out from under Microsoft's umbrella?

Oh, better switch to bitlocker and onedrive then...

Probably an "accident'", until CIA got what they want.

I keep dual boot with Windows available for my wife. About a year ago my Fedora install was stuck in a boot loop and I hadn’t used my PC in a good while, nor updated anything the last time I had used it. The only conclusion I can think of is either bitflips corrupted the boot process, or Windows fucked with my Fedora install at some point while — perhaps my wife’s activity allowed a Windows update through, I don’t know. They’re on separate drives though, so… I recovered my data and reinstalled, kept Windows but I am now extremely sensitive to any shenanigans from that drive. Reading this news has me considering to tell my wife she will have to use Windows from a VM on my PC.

Mysteriously? Really?

The reason was clear, they never got the email for account verification, and were locked out. MS messed up.

I really hate headlines these days.

Thanks for evolving VPN, Wireguard. Here's a boot in your face! ~Microsoft

No Such Activity at play.

My conspiracy theory: those signing keys are very "tasty" maybe Microsoft was aware that some state-sponsored attacker got hold on them and blacklisted for everyone's safety.

Imagine what would happen if NSA or that other Israeli spy company could sign fake veracrypt or Wireshark binaries

Hanselman pointed to a Microsoft blog post noting that, starting in October, the company began requiring "mandatory account verification for all partners in the Windows Hardware Program," which also covers certifying software drivers. Last month, the company updated the post to say: "Accounts that did not successfully complete account verification and received a Rejected verification status have been suspended from the Windows Hardware Program, and submissions from these accounts are no longer permitted."

So they didn't hand over their blood and urine samples to Microsoft so they don't get to be developers anymore

Microslop.

"Not every 'WTF micro$oft' moment is a slam dunk,"

Brother, your quotas of shit hitting the fan is reaching fecal velocity of new degrees. Your company's current state of existence has absolved you of the right to a balanced perspective.

What I'm trying to say is it's never gonna Microsoft 100% of the time, but at this point no one trusts you, and you've earned that, and now you have to live with the consequences. I know this Microsoft contact is probably not the reason, but he is still working there, and that means he deserves some of the blame on a constructive level.

Microsoft’s partner portal website mysteriously said his account had been deactivated, without specifying why.

My money is on Microsoft's AI based detections causing false positives again. I spend way too much time chasing ghosts from Defender. Their machine learning based signatures are especially egregious. You get an alert with a name like "Win32/Wacatac.b!ml". That last "ml" bit denotes that it's machine learning based. And then you get fuck all to help you determine why the alert fired. Sure, it might actually be a trojan. More likely, it's a false positive. But who knows, because Microsoft won't provide enough information to perform a reasonable analysis of the binary.

And MS has been pushing CoPilot hard. It's in everything and it's happy to slop up answers for you. The accuracy of those answers though can be a bit spotty. I'd certainly never turn it loose on tools which can have business impact. But, I doubt Microsoft has any such reservations about letting CoPilot slop all over third party devs.