
I don't know the details, but the fact that there is some sort of master-key at all sounds like a very serious design flaw. Makes me wonder how the service could even have passed a security review prior to launch. If I was using Azure I'd think this was a very worrying symptom. It would be interesting to know exactly what the f*ck-up was.