Post B6FR1HP1RmfXbMtG88 by Rairii@labyrinth.zone
 (DIR) More posts by Rairii@labyrinth.zone
 (DIR) Post #B6FQjB1UQZAkbTFcg4 by mcfly@milliways.social
       0 likes, 0 repeats
       
       RE: https://cyberplace.social/@GossiTheDog/116565662607962457This YellowKey Bitlocker Bypass Vulnerability is seriously crazy. As if someone found a government / law enforcement backdoor.... #infosec #cybersecuityRT: https://cyberplace.social/users/GossiTheDog/statuses/116565662607962457
       
 (DIR) Post #B6FQjBDtgR65Dx3X16 by Rairii@labyrinth.zone
       0 likes, 1 repeats
       
       @mcfly not really, i've found enough vulns to dump bitlocker keys before.to me, it looks like just someone fucked upbasically modern NT has a system called "Velocity", where code can be gated on one of "always on, default on, default off, always off", when it's set to always off it's effectively ifdef'd out of the build, and the settings can be different per branch.Basically the idea is when a coder develops a feature they have it set to always off except in their branches, and later on it's set to one of the other three (default on/default off can be used for A/B testing), I assume this functionality was supposed to be set to always off except for a couple of branches, and someone set it to always on by mistake when merging something else.
       
 (DIR) Post #B6FR1HP1RmfXbMtG88 by Rairii@labyrinth.zone
       0 likes, 0 repeats
       
       @mcfly besides, bitlocker already has a "law enforcement backdoor", in a consumer scenario recovery keys get escrowed to microsoft and law enforcement can just ask ms for them
       
 (DIR) Post #B6FRYNM8KjcXcdJvW4 by mcfly@milliways.social
       1 likes, 0 repeats
       
       @Rairii from what i know from governments is that they would like to have multiple. In case one is not working (in case of for example someone blocking internet during installation...)
       
 (DIR) Post #B6FRj1a7d8yFH8wPx2 by Rairii@labyrinth.zone
       0 likes, 0 repeats
       
       @mcfly i think the attempted fix for "blocking internet" was the whole "you must be connected to internet and log in to microsoft account during oobe" thing