Your Locked Drive Has a Second Key. It Isn't in Your Pocket.

You remember the moment, probably. Unboxing the new laptop — or finishing the Windows setup on a machine you already owned. Somewhere between the Wi-Fi password and the privacy toggles, a line appeared, checked and greyed out, or a quiet notification a day later: Device encryption is on.

Most people read that as good news. The padlock icon showed up in File Explorer. The drive was encrypted. One more thing handled, one less thing to worry about.

Here's the question nobody asks on setup day: how many keys open that lock?

Because when you signed in with a Microsoft account, Windows did something helpful without making a fuss about it. It took a copy of your recovery key — the master key that unlocks the whole drive — and filed it away in your Microsoft account. You can see it right now at account.microsoft.com, under your devices: a string of numbers, labelled "recovery key." This isn't a leak or a hack. It's in Microsoft's own documentation. It is a design choice, made for a perfectly reasonable purpose: so that if you forget your password, you're not locked out of your own machine.

And that is exactly where the trouble starts. Not with malice — with arithmetic.

A Second Key Is a Second Person Who Can Open the Lock

Think of it as a physical safe for a moment. You bought a good safe. It has one key, and that key is in your pocket. But the locksmith who installed it quietly kept a copy in his own drawer — "in case you lose yours," he'd say, and he'd genuinely mean it.

Would you sleep well? Of course not. The question was never whether the locksmith is trustworthy. The question is structural: a lock with two keys is not the same object as a lock with one key. Every additional key is an additional person — or account, or company, or legal process — that can open it.

That recovery key in your Microsoft account is that second key. It's protected by your account password, by Microsoft's security practices, by whatever a court order can reach. A stolen Microsoft account now unlocks more than your email — it unlocks your encrypted drive. An account locked out for suspicious activity doesn't just lose you Outlook — it strands the key that rescues your own data. None of these scenarios requires Microsoft to misbehave. They only require the key to exist somewhere other than your pocket.

The Office Already Knows This

If you've ever been issued a company laptop, you know the quieter version of this story. In most workplaces, the IT department holds the recovery keys for every machine it hands out. It's standard practice, and it exists for sane reasons: employees leave, passwords get forgotten, drives need reimaging.

But notice what that means. The encryption on your work laptop was never there to keep the company out. It keeps strangers out — the thief who grabs the bag at the airport, the person who finds the laptop on a train. Against anyone holding the recovery key, the lock is decoration. Your "encrypted" drive and the IT department's key drawer are one system, and you are only half of it.

This is the pattern nobody talks about: every "what if I lose my key?" design is an answer to loss. Nobody is designing the answer to a different question: what if one more person can open it?

Escrow Was Never Required. It Was a Trade.

Here's the part that reframes everything: storing your key with someone else was never a requirement of encryption. It was a price you paid for convenience.

Look at the other end of the spectrum. Tools like VeraCrypt — open-source, no account, no cloud — are designed the opposite way. There is no "forgot your password?" link. There is no company that can rescue you. You set a passphrase, the software scrambles the drive, and if you lose the passphrase, the data is gone, full stop. Brutal? Yes. But it proves the point cleanly: key escrow is not a property of encryption. It's a property of convenience. Somewhere along the way, the industry decided that "you'll never be locked out" was worth more than "only you can get in."

Sticky notes with passwords on office monitors. Recovery keys in IT key drawers. Device encryption quietly tied to a Microsoft account. Different eras, same bargain: every design that protects you from losing access adds someone who has access. The trade is always presented as convenience. The cost is always stated as nothing.

True Ownership Is Knowing There's Only One Key

Seneca wrote at length about how we mistake possession — that what we cannot fully control, we merely borrow. The encrypted drive in your laptop is borrowed in exactly this sense. You own the hardware, the data, the lock — but the decisive object, the key, exists in duplicate, and the duplicate answers to someone else's terms of service.

The only real fix is structural, not technical. Not a better algorithm, not a longer key — one key, in one pair of hands, with no "just in case" copy anywhere. Convenience and "only I can open this" are mutually exclusive here. Once you see that, you stop asking which encryption product to buy and start asking a sharper question: who else holds a key to my lock?

The One Thing We Refuse to Do

And here is where I should be honest about my own industry. There are custody services — mine included in the broad sense — that will happily say: "encrypt your drive, and we'll keep your password safe for you." Store the key, they say, and you'll never lose it.

We don't. As a matter of principle, we refuse to.

Because that offer is the hole. The moment a service holds your key, it becomes the second keyholder — the locksmith's drawer, outsourced. Whatever its intentions, whatever its security budget, the structure is identical to the problem we just dismantled. A trustworthy second keyholder is still a second keyholder.

So here's the entire shape of our job: you encrypt. The key stays with you — written nowhere we can reach, known to no one we employ. What comes to us is a drive nobody can read, including us. We receive it, give it a number, seal it with a numbered brass band, photograph it, and two people verify the whole thing. Twice a year we look at the seal, check the casing, take a photo — and never touch the data. If you ever want deeper checks, that's your written instruction, not our routine. The drive sits in the dark, unreadable, unbothered. The lock on it has exactly one key, and it is in your pocket.

That is what "only you can open it" actually requires. Not a better product. One key.