Recently, the power supply of my PC exploded. That happens (apparently more than I thought 🤔). So I turned my PC in for repairs; it was still under warranty after all. I figured the shop would replace the power supply, measure the power through the device and that's that. They did that... and something else.

Just like every other home computer, it has personal stuff on it. Emails and documents I'd better save, passwords, websites, projects, all that stuff. Most of it would be bad to lose, but not the end of the world; just a pain in the ass. But there is other stuff on there, too. Stuff like certificates and cryptographic values that are tied to my account, in a specific environment, under specific circumstances. And when the system recognizes something has changed, it locks down those values and certificates.

Both my device and Microsoft account are secured by several features: passwords, an authenticator, a PIN, etc. Every time I turn on my PC, it demands I enter my PIN and all is well. So imagine my surprise when I got my PC back two weeks after turning it in to discover... Windows boots directly to my desktop.

A little more than "What's the password? 👀🚪"

These days, login options are a bit more sophisticated compared to a few years ago. Even if the ritual itself hasn't changed, the underlying mechanisms it triggers have. There is an entire flow of checks that go ham every time you log in. "Did the on-board hardware change?" "Did the Windows environment change?" "Is the user from yesterday still the same user today?" these questions are all simplified and a bit theatrical, but I am trying to say there is more going on than just one guy standing at the door demanding your password. Your name, your sign-in settings, device identifiers, and plenty of other information, are used to create a "chain of identity". If nothing changes, we can reasonably assume we are who we say we are.

Because a blown PSU is not something you plan for, I didn't exactly have time to prepare my system for repair. No extra "service" account and no lifted sign-in measures.

Yanking the chain

I don't know exactly what happened, but my best guess is that someone used the Windows Recovery Environment (known as WinRE) to use CMD to access Windows and lift the sign-in measures. It is not completely unheard of or even suspicious, but it caused issues they didn't foresee. Data deemed "sensitive" is linked to the integrity of a user account. This means things like passwords, keys, and certificates are linked to the circumstances that were known to the user at the time they were created. If enough of the circumstances change without me signing off on it, Windows considers these values to no longer be mine.

For signed-out websites, whatever, just log in again.

For self-signed certificates, that's a bit of a problem... Certificates come with a set of keys: a public key and a private key. The public key is plainly readable on the certificate. The private key, however, is a secret tied to the user (or machine) the certificate is installed on, and thus depends more heavily on the "chain of identity". The Article Writer requires a certificate tied to my user account in order to save, edit, and publish for the Hatchery. You can imagine how unpleasantly surprised I was that the app quietly failed to get the certificate. After hours of trying and failing to fix the issue, I resorted to creating a new certificate and invalidating the old one. So the Article Writer app is back in business, but in all honesty, the situation didn't sit right with me.

"Hmm, I recognize you... 🤔"

So, Windows isn't feeling like it used to. Either that is a side effect of Venus being in retrograde or whatever, or someone poked at my account through WinRE. Windows does occasionally remember who I am, so it tries to fetch data; the security guard at the door looks at me funny and says, "No idea who you are," even if three other people have already verified my identity. 

So what's the take?

Nothing really... stuff happens. I do think the shop could have asked me how I wanted them to test the repair instead of WinRE-ing its way into the machine, but that is a choice they made. But now I have a Windows environment that seems to be limping every now and again; it'll take a bit to fix it. And I can't register a new PIN for this device now... 

Overall experience: "Meh, wouldn't recommend blowing up your PSU."