Yet another reason to switch to Linux.
Copy Fail, Dirty Frag and Fragnesia exist. What are you going to switch to now?
They will be patched. There is also no indication that they 'be been known and exploited till recently.
This was allegedly deliberately non patched to be exploited.
Getting a system without bugs and security issues is impossible, you can at least avoid intentional compromise.
Those are potential vulnerabilities that can be patched. This is an indication that MS intends for bitlocker which you really need to be secure to bother using windows on a laptop to never be secure by design.
I always wonder whether to block people like you.
Sometimes I see your comments and get angry at how stupid you are.
Other times I see your comments and become really aware of how intelligent I am compared to… whatever the hell you are.
Yeah, Copy Fail, Dirty Frag and Fragnesia are bad but holy fuck.
Copy Fail in Linux sounds similar.
One is a backdoor, another is a bug. How are they similar?
It does not.
Why are you lying? One is a privilege exploit that has been patched. It lets someone who can already run software on your machine do more. This is a backdoor that could allow hostile governments or thieves to steal your files from any machine in their possession. Things what would always have been secure on any Linux machine from the last 20 years.
This Chaotic Eclipse/Nightmare Eclipse is the same one whose opening post read:
I never wanted to reopen a blog and a new github account to drop code…
But someone violated our agreement and left me homeless with nothing. They knew this will happen and they still stabbed me in the back anyways, this is their decision not mine.
I’m guessing there’s plenty more to come.
Kinda funny that they’re targeting Microsoft and yet using GitHub to share the PoCs.
Kinda funny that they’re targeting Microsoft and yet using GitHub to share the PoCs.
This is the part I don’t get either. Although - maybe it is because it protects other platforms from legal action by microSLOP? Also, it adds to the Streisand effect should microSLOP remove the proof of concept from its own platform.
Seems. Like bløgspot is a banned word…
Isn’t this the blue hammer guy?
more evidence that michaelslop binbows is trash
linux is better
luks wouldnt do this to u
I guess anyone who uses ShitLocker is shit out of LUKS.
i dont so im not
Bitlocker is TEMU encryption
It really isn’t. The encryption itself still hasn’t been defeated. The implementation is the problem. Microsoft just can’t get out of their own way. If they ignored all the business majors, nobody would be able to stop them.
Lol, if they ignored that they would have gone extinct in the 90’s
Install Linux, Problem Solved.
More than ever.
Of course they did. They have no interest in protecting your privacy and every interest in making you think they do. I would’ve been way more surprised to learn there wasn’t a backdoor.
I’m left puzzed as to how this works …like… the data on the disk should be encrypted sector by sector…it takes forever to encrypt or decrypt a disk which is consistent with that understanding.
When you boot into PE, I don’t understand how that OS can read anything off the disk, yellowkey or not, without knowing the encryption key…so how does it get that key. Is the vulnerability here that the key is stored in the TPM and win PE can be convinced to retrieve it without the proper credentials being provided ?
If that’s the case, and the TPM can just provide the key on request…then… where is the security here ?
My guess is that the key to decrypt the disk is stored on the disk, encrypted by a Microsoft-known key. This seems to unlock that copy of the key rather than the copy encrypted by your own key.
Though he did say to put the disk back in the original system in part of the instructions, so it might be TPM based. The way to check would be to try this on a system with a disk from another system, or with a wiped TPM.
TPM is not security, it’s security theatre. If you don’t need to type a password in or insert a device with a key on it during boot, then it’s not secure, period.
The entire Microsoft, Apple and Google ecosystem is USA backdoors. That’s why I call it American spyware.
And they tell us to worry about China. :)
It’s called misdirection, every magician and thief knows about it :D
You mean that thing everyone knew about since the authorities derailed open-source TrueCrypt and forced them to message their users that they should migrate to BitLocker?
There’s an open-source successor to TrueCrypt called VeraCrypt. For that matter, as far as I know, one can still download the last version of TrueCrypt. It hasn’t been disappeared.
It’s true that the TrueCrypt developers retired and said that commercial packages like BitLocker were finally good enough and available enough that they didn’t feel compelled to maintain TrueCrypt. I remember that. I think it’s plausible that Microsoft has (or has provided to someone) back-door access to BitLocker, but I don’t remember any hint that the TrueCrypt developers had been coerced; have you got something you can link to?
These days, if you’re not on Windows you can use luks or just zfs with encryption enabled. Code is open and can be audited by anyone. But yes, VeraCrypt to my knowledge is also still a viable option.
Certainly at the time there was talk of coercion, there was talk the developers had been asked to put in a backdoor, had refused and then been encouraged to cease and desist their work on TrueCrypt and provide written recommendation of BitLocker, the wording of which did not seem to be their own. But people like conspiracies, maybe the authors did just move on, and if that was encouraged it probably was not as sinister as suggested. Security and privacy will always be duking it out.
But people like conspiracies,
In spite of the fact that they never happen and that government mass surveillance isn’t a thing and hasn’t been exposed repeatedly for decades and that we all know they have not been aiming to do this exact thing for the better part of a century and that they are genuinely evil and literally never prove themselves to be over and over and over.
Seems like every week there is another reason why I’m thankful I switched to Linux a few years ago.
Only thing I find annoying with full volume LUKS encryption is that it makes it difficult to resize partitions, it’s a whole thing, but it’s a minor hassle and not something I’d do every day anyway.
Why not just encrypt the whole drive and then use virtual partitions within the encryption?
I like to use btrfs subvolumes inside a luks lvm volume for this reason.
What? Btrfs subvolumes are basically the same as logical volumes. That’s somewhat redundant.
Good.
We always knew it was there. They sold their soul to the NSA decades ago.
I remember the day I saw the “Intel! Inside” commercial and the logo, and I thought, I don’t fucking trust this company.
Yeah no shit Intel inside, you’ve got every fucking three letter agency inside.
I knew it was over the day they introduced UEFI and TPM.
Wait what’s wrong with UEFI? My computer uses it, although I have an AMD chipset if that makes a difference…
Mostly the “secure boot” crap, which you can turn off (it’s more a “running your own software on the machine” risk than a privacy risk). UEFI in general isn’t too bad (way way WAY more complex than BIOS though) and managing EFI bootloaders is so much less hassle than with BIOS boot!
– Frost
All I know about secure boot is that if I make a custom ISO and try booting from it, I would need to create a signature first, register it in my UEFI, and use it to sign the ISO.
Seems like a pain in the ass, but then again if I want to play with a custom ISO I can do so in a VM, and that seems kind of worth it to prevent someone from booting whateverthefuck if they somehow gain physical access to my computer…
So what are you using and recommending?
Tech megacorps are the fifth estate of their home countries, trusting your data to Microsoft or Google is essentially the same as handing it directly to the FBI and CIA.
LUKS, never had these problems…Too bad Win11 won’t boot from it.
Okay, but what’s the downside
Cold boot attacks?
Dunno… Somehow that seems like a feature to me 😉
Yo tambien
Edit:
A mi tambien*a mi tambien
that makes quatro of us.
Sinco por el kulo te la inco
¿La promesa?
No, lo que tengo debajo de la mesa.
Gracias amigo! Lo siento para mi espanol es malo.
No hay nada por lo que pedir perdon! Fue una correccion menor, se entiende lo que quisiste decir de todas formas :)
Que amablé eres.
