upvote

points

by OptionOfT17 hours ago |
comments
upvoteby lifeisloving17 hours ago|
next
[-]
MS stores your Bitlocker keys on Microsoft servers now if you ever login with a OneDrive account, at least they were.

And MS has handed those keys over to law enforcement before.

reply
upvoteby caymanjim16 hours ago|
parent|
next
[-]
That's how it works by default, but you don't have to use it that way. BitLocker can be used securely.
reply
upvoteby ByteOfWood16 hours ago|
parent|
[-]
You should not be trusting a company or product that has been known to give up keys, regardless of how you are using it. Too risky
reply
upvoteby saidnooneever14 hours ago|
parent|
prev|
next
[-]
people rolling windows and saying high security environment in the same phrase are likely not aware what is a highly secured environment in the first place so it doesnt matter where those keys are -_-. I have never encountered these types of devices nor windows in a high secure environment. free software and BSD. Occasionally Linux but that is also mostly avoided or manually tampered with / built and hardnened to get around its rubbish security. sometimes there is an alternate deployment linux based (very hardened) in the event of a security issue on the other more secure platform in case that one does happen to spring a leak. (might be more needed now its easier to pick apart these systems).

some highly secure environments have connections comming from networks that sport windows. usually they will come in via something like a data diode so whatever comes in can physically not come out because its so risky to allow even such a network to connect to yours....

perceptions of what is highly secure can vary a lot depending on what a person has encountered. if you ever come across a place that is really secure u'll immediately know the difference.

ive never seen a highly secure corporate network and have seen close up what security is implemented in fortune100 etc. its a doozey. they just pay vendors with big retainers for IR etc. to be compliant and insured. that is not security. (and they spend millions on that which is funny as hell)

reply
upvoteby PorciiVorbesc13 hours ago|
parent|
[-]
>nor windows in a high secure environment

I have. We had an air-gapped network for ingesting and processing the deliverables and results of security audits and pen-tests at work. It was running windows and not Linux/BSD like the laptops of the pentesters, because most of our customers were MS shops so all deliverables we got from them were mostly documents, apps and files that were designed for Windows apps or had better compatibility on MS Office, and businesses stay solvent by conforming to their customers' needs instead of fighting them.

reply
upvoteby InvisibleUp16 hours ago|
parent|
prev|
[-]
I suppose it works if your threat model is corporate espionage and not state actors.
reply
upvoteby chasd0016 hours ago|
prev|
[-]
You can probably implement your own these days. I would use a model to generate a requirement document, then human review, then generate an implementation plan, then human review, then take it to build. Have a different model to a code review and testing. End with human code review and testing.

You could make your own BitLocker conforming to your requirements without relying on or trusting any cloud or corporate entity.

reply
upvoteby fn-mote16 hours ago|
parent|
[-]
And then turn Mythos onto your code to make sure you don’t have vulnerabilities? That’s a lot of faith in the security of LLM-written code that I wouldn’t have in human-written code.
reply
upvoteby chasd007 hours ago|
parent|
next
[-]
The point is the code is there in front of you. You can audit it, study it, turn mod and after model loose on it, do whatever you want. You’re going to have to compile it so you need to trust the compiler but at least it’s not some cloud provider.
reply
upvoteby hparadiz14 hours ago|
parent|
prev|
[-]
Been daily driving this for a month

https://github.com/hparadiz/nexus-6p-biokey

I mean it's better than this sdcard thing at least.

reply