Keyhole – Forge own Windows Store licenses (massgrave.dev)

Article summary

The article discusses a bug in the Windows Client Licensing Platform (CLiP) called 'Keyhole' that allows users to bypass digital rights management (DRM) and activate any Microsoft Store app or Windows edition. The bug was discovered independently by the authors and reported to Microsoft by Cisco TALOS. The article explains how the bug works and provides a step-by-step guide on how to exploit it. The bug has since been patched by Microsoft.

Main themes

• Windows licensing
• DRM bypass
• CLiP vulnerability
• Microsoft security
• Xbox DRM connection
• TPM and Pluton

What commenters say

• The Keyhole bug allows users to easily activate Windows and other Microsoft products without paying for a license.
• The existence of the Keyhole bug and its similarity to the Xbox DRM system raises questions about Microsoft's true motivations for implementing Pluton and TPM in Windows.
• Some users believe that Pluton and TPM are primarily intended to enforce DRM and lock down user freedom, rather than improve security.
• Others argue that while Microsoft may benefit from these technologies, they can also provide genuine security benefits for end users.
• The use of SMS for two-factor authentication is seen as insecure and inferior to other methods, such as TOTP or FIDO2 keys.
• The implementation of TPM and Pluton may lead to issues with device compatibility and potentially render older devices obsolete.
• Some users are skeptical of Microsoft's intentions and believe that the company is trying to exert more control over user devices and data.
• Others argue that the ability to install Linux and other operating systems on Windows PCs, as well as the presence of third-party software, suggests that Microsoft is not trying to completely lock down user freedom.