Item — HN Reader

At what point will Security professionals start turning down roles that involve “securing” MS Products? I’m already at this point.

Securing Microsoft products is busy work while waiting to have it undercut by the next wave of MS’s insane tech debt and greed. And now backdoors!

4 comments

You are confused. They are not "security" roles, they are compliance roles. That's all most enterprise customers really care about. They satisfied all of the compliance rules, and are following "best practices" (influenced by MS), anything that happens is not their fault.

And having more busywork to do is actually a good thing. Having people employed to do said busywork shows how serious they are about "security", without requiring any skills that are difficult to hire

As opposed to iOS, which does iCloud backups that are not E2E encrypted by default, so that law enforcement can request your chats (except Signal because they opt out), browser history, etc.?

You can enable ADP for E2E encrypted backups, but it's probable not going to help you much, because the people you are communicating with likely didn't.

This is not to defend Microsoft, more to say that all these companies were part of PRISM.

>You can enable ADP for E2E encrypted backups, but it's probable not going to help you much, because the people you are communicating with likely didn't.

That just sounds like a fundamental issue with security in general, not specific to Apple/Microsoft.

My point is that these defaults that look secure to a non-expert, but do not hold up to scrutiny, are probably intentional.

I have found that even many tech people have incorrect beliefs about these things, like assuming that iCloud Backups are E2E encrypted by default or that disabling Allow Apps to Request to Track disables trackers inside apps.

Not in the UK sadly, ADP is disabled.

> This is not to defend Microsoft

But you are defending MS, conflating a bunch of things, mainly full disk encryption and cloud backups.

There's a big difference between Apples cloud backup which has documented behavior and a backdoor. I'm also fairly confidant in Apple's full disk encryption, they've gone to court to defend it. There also a lot more data points we can use to judge Apple vs Microsoft on privacy and security, and MS comes out looking bad.

I think my message wooshed. I was not comparing disk encryption and iCloud backups. My point is that insecure defaults are Apple and other's alternative to backdoors. They give plausible deniability ("how is someone able to recover their data if they lost their credentials and we used E2E?"), while at the same time satisfying law enforcement, because the vast majority of people is not aware of them.

Another example is WhatsApp on Android, by default when backups are enabled, they are stored unencrypted in Google Drive. A good counter-example is Signal, which opts out of backups on iOS and Android and the only option is to do E2E backups to their own servers.

I'm also fairly confidant in Apple's full disk encryption, they've gone to court to defend it.

FWIW, in the last leaked report, iPhone was not an issue AFU for Cellebrite (macOS is most likely even easier due to looser security):

https://discuss.grapheneos.org/d/14344-cellebrite-premium-ju...

Signal won't let us download our own data and back it up using our own secure systems. Whatever its other merits it gets 0% for backup policy.

Though I suppose then I have to give a negative % to all the systems that have insecure online backups. This whole area is a train wreck really.

> ‘Signal won't let us download our own data and back it up using our own secure systems.

Signal is slowly, very slowly, moving toward providing real backups and cross-device transfers

I understand why you’d believe Signal still can’t deliver that, because they had been ignoring the user demands for years.

But there is real progress now

https://support.signal.org/hc/en-us/articles/9708267671322-S...

It's not a matter of belief. Signal does not provide a way for me to download my own messages off my own devices and safely store them using my own secure backup facility.

Obviously Signal don't owe me anything. I'm not paying for the product and I appreciate what it does offer and makes available for free. But it would be much better if it also supported local backups under the user's control.

> And now backdoors!

"now"?

Shall we have a discussion about the excuse Microsoft gave as to why keys they claimed, back then, were "secondary keys" belonging to Microsoft, were called ..._NSAKEY when a version of Windows NT shipped, by mistake, with debug symbols on?

One time, just freaking one time, a version of Windows shipped with debug symbols on and, by chance, there had to be cryptographic keys named "NSAKEY" in there.

Yeah.

Now that people constantly turning a blind eye on the wrongdoings of the state are of course going to say that it's totally normal and just repeat the, carefully crafted, excuses from Microsoft from back, that it was totally not a backdoor etc.

The bit I never understood in this story is the accidental leak of the debug symbols. Microsoft publishes them anyway. They are not a secret. Back in the day, the symbols shipped on the CD, and they published updated symbol packages for service packs. Nowadays they are published on the web and their debuggers download the symbols automatically.

Had to look this up myself.

https://en.wikipedia.org/wiki/NSAKEY

Microsoft has shipped debug symbols plenty of times.

For enterprise, there seems to be so much money in doing it, that I don't think people are going to start turning it down just because it's troublesome.