Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

In earlier version of Windows (Windows 2000, Windows XP, Windows Vista, Windows 7), my various secrets are protected with RSA encryption:

  • encryption file system
  • saved credentials
  • IE passwords

And my RSA private key is encrypted with my user account's password. That means the only way someone can access my encrypted files is to know my Windows account password.

And while my Windows account password is stored as an unsalted MD4 hash1, and time has exposed the weakness in the idea of using MD4, or unsalted hashes, it's still as strong as it is. The only way you can break it is to actually:

  • already have my password in your rainbow tables
  • chew on my 21 character password for a few years

Realistically the best anyone could do is break into my home and either install a keyboard wedge, or modify core OS files to instruct it to record password data.

Windows 8

Now we have Microsoft Accounts, where my account credentials are no longer "local", but are held by Microsoft in the cloud. While Windows 8 can cache my credentials locally (for the periods when i don't have an Internet connection) generally authentication happens remotely.

How secure is my information now with this new system?

What happens if a grand jury issues a warrant against Microsoft to get my password, in order to access my locally (EFS) encrypted data. What information does Microsoft have?

Is it as insecure as a web login, where the web-site knows my password? Or is it more like Kerberos, where we have a "shared secret", and no actual password flows anywhere? Since Microsoft is not documenting their algorithm, nobody knows the algorithm.

Does anybody know the algorithm?

share|improve this question

closed as not constructive by techie007, Kyle, Simon Sheehan, CharlieRB, Karan Dec 27 '12 at 0:24

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

6  
Just to be clear you state: "Since Microsoft is not documenting their algorithm, nobody knows the algorithm." then ask: "Does anybody know the algorithm?" I'm confused... –  Kyle Dec 26 '12 at 16:57
    
@Kyle Just because i said, "Microsoft is not documenting their algorithm" doesn't mean Microsoft is not documenting their algorithm. Just because i've not found it documented, blogged, talked about anywhere doesn't mean it hasn't been documented, blogged, or talked about anywhere. i'd love to be proven wrong. –  Ian Boyd Dec 26 '12 at 18:51
    
See that "I've" part is very important... Otherwise you are asking for documentation for something that is undocumented. Was my confusion unreasonable? –  Kyle Dec 26 '12 at 21:38
    
"I've" means little ol' me. Just because a humble peon such as myself hasn't found it - doesn't mean the great SuperUser can't find it. –  Ian Boyd Dec 26 '12 at 22:17
add comment