Windows Recall demands an extraordinary level of trust Microsoft hasn't earned(arstechnica.com)
arstechnica.com
Windows Recall demands an extraordinary level of trust Microsoft hasn't earned
https://arstechnica.com/ai/2024/06/windows-recall-demands-an-extraordinary-level-of-trust-that-microsoft-hasnt-earned/
32 comments
The research is... kinda bad. Beaumont critzies that Microsoft stores the data... locally in an SQLite database? Because it's "easy to steal with malware" (just like your browser history, etc). Blew up in the media though...
What's the difference between stealing some random sqlite database and the history of OCRs of screenshots of anything ypu did on that PC?
What's the difference between stealing the history of OCRs of screenshots on anything you did versus the ability to steal my tax/financial documents, business trade secrets, private letters, photos and other information commonly stored on a computer which can be taken in the same manner whether it is on Windows, Linux or macOS?
This Recall feature keeps text of emails typed and never sent, of documents viewed and deleted.
And that makes the security associated with it any more important than my kept documents how?
It's the more exposed thought process that shines a strong light into your mind. It's not just what you do but the why.
It's no wonder collecting this info is a priority. It will be a goldmine for dataminers with the right correlation. Sure right now it's not collected centrally but I'm sure sooner or later there'll be a quick "just click off this tiny T&C update before you continue" crossing our paths.
Also, it means that this confidential info is now in more places than one. It's no longer sufficient to encrypt a file and lay it on a usb stick in the safe.
And it's also there in centralised place ripe for the taking. Not even any need to scan the system to find valuable information.
It's no wonder collecting this info is a priority. It will be a goldmine for dataminers with the right correlation. Sure right now it's not collected centrally but I'm sure sooner or later there'll be a quick "just click off this tiny T&C update before you continue" crossing our paths.
Also, it means that this confidential info is now in more places than one. It's no longer sufficient to encrypt a file and lay it on a usb stick in the safe.
And it's also there in centralised place ripe for the taking. Not even any need to scan the system to find valuable information.
Text on screen can be more confidential than text on disk.
And it can be the other way around. I still don’t get why this demands some new level of security beyond what protects other data.
So I want to read an encrypted mail, then delete it. What do I do?
If someone has admin access to your PC (which they need to access the SQLite file) they could also just install malware that sends everything you do and type over the network.
Your trust is not required. Like all the "features" Microsoft has forced on its users in the past, it will run on your (their) computer whether you trust them or not. Sure, a few nerds like me will ditch them for other OSes, but most Windows users are trapped, and Microsoft can do whatever it wants to them.
Trust is moot when someone can abuse their position with no consequences. Windows has been the overwhelmingly dominant desktop OS for 30 years and it is unlikely to lose that position any time soon.
Trust is moot when someone can abuse their position with no consequences. Windows has been the overwhelmingly dominant desktop OS for 30 years and it is unlikely to lose that position any time soon.
It's really refreshing and heartening to see the criticism on Microsoft in the comments there on ars.
I work in a typical MS shop and as usual their evangelism is really strong. Everyone in the admin team is a hardcore Microsoft promoter, everywhere from internally on Yammer and externally on socials. They're probably fishing to get made MVP. But still, I have more self-respect. While they're all eagerly piling on Copilot studio I'm making my own bots with ollama. I don't like having my knowledge and experience locked behind someone else's brand and interests.
I'm very critical and feel they are a mediocre company which mainly floats on being "just good enough to not pass over" because of their marketshare. The old "nobody got fired for buying IBM" thing. I don't think they're actually leaders in anything. They're just big so they're hard to get around. Every third party solution we've replaced with a MS alternative was more capable, more ethical and easier to use. It was always a step back to settle for the MS solution.
Now again with the whole Copilot war they can do nothing wrong in the eyes of my colleagues. I'm glad to see I'm not the only one seeing this.
I work in a typical MS shop and as usual their evangelism is really strong. Everyone in the admin team is a hardcore Microsoft promoter, everywhere from internally on Yammer and externally on socials. They're probably fishing to get made MVP. But still, I have more self-respect. While they're all eagerly piling on Copilot studio I'm making my own bots with ollama. I don't like having my knowledge and experience locked behind someone else's brand and interests.
I'm very critical and feel they are a mediocre company which mainly floats on being "just good enough to not pass over" because of their marketshare. The old "nobody got fired for buying IBM" thing. I don't think they're actually leaders in anything. They're just big so they're hard to get around. Every third party solution we've replaced with a MS alternative was more capable, more ethical and easier to use. It was always a step back to settle for the MS solution.
Now again with the whole Copilot war they can do nothing wrong in the eyes of my colleagues. I'm glad to see I'm not the only one seeing this.
Local LLM code autocomplete for the win. I use Twinny and LM Studio. It rocks.
Even if there's a "disable" button, I don't trust them to actually honor the disable button either.
"Hello, each and every Windows Update actually switches that button from disable to enable. All you have to do is remember to switch it back after every security update." --The future based off Microsofts past behavior.
This is why I left windows recently[0]. When you design an OS that doesn't respect the user's choices, you are no longer in control of the OS. Windows 11 shifted to trying to force people to use Edge. You can't even change the default browser in many cases without some serious work.
And the FTC is going after anyone but Microsoft for anti-competitive behaviors. The desktop world looks bleak for people that depends on Windows.
[0]: https://www.scottrlarson.com/publications/publication-transi...
And the FTC is going after anyone but Microsoft for anti-competitive behaviors. The desktop world looks bleak for people that depends on Windows.
[0]: https://www.scottrlarson.com/publications/publication-transi...
"Your privacy is very important for us" when they were pushing me to accept the cookies on the Edge home screen.
I trust Microsoft to not send photos/videos of user activity back to home base. Seems like a lot of bandwidth.
What I imagine will happen is the Recall feature will send summaries of user activity back to Microsoft. That way, it's "anonymized" and somehow legal
What I imagine will happen is the Recall feature will send summaries of user activity back to Microsoft. That way, it's "anonymized" and somehow legal
> I trust Microsoft to not send photos/videos of user activity back to home base. Seems like a lot of bandwidth.
And you trust them also to not report you to 3 letter agencies when they see "something unusual" ? /s
And you trust them also to not report you to 3 letter agencies when they see "something unusual" ? /s
For MS to even think Recall was a good idea is quite worrisome.
Financial services, government departments (including things like criminal cases), healthcare - talk about a privacy and confidentiality nightmare.
It should be interesting to hear the inside story about how this was championed inside the company and how it got the greenlight from the higher ups.
Financial services, government departments (including things like criminal cases), healthcare - talk about a privacy and confidentiality nightmare.
It should be interesting to hear the inside story about how this was championed inside the company and how it got the greenlight from the higher ups.
Microsoft seems unaware how much pr0n and other “objectionable” material its users peruse.
Why do you think so ?
They (and the NSA) just want your data.
To clarify: They don't collect your data because they are perverts. They are required to do so.
They (and the NSA) just want your data.
To clarify: They don't collect your data because they are perverts. They are required to do so.
It was a charitable interpretation. I agree with you, there’s more to it than just “helping the user”, most likely. Wouldn’t be the first time.
Related and mentioned within:
Recall: Stealing everything you've ever typed or viewed on your own Windows PC
https://news.ycombinator.com/item?id=40540703
Recall: Stealing everything you've ever typed or viewed on your own Windows PC
https://news.ycombinator.com/item?id=40540703
It is a privacy invasion scheme --- one that consumes both compute and storage bandwidth.
Beyond this, the only feature I will be looking for is how to disable it.
Beyond this, the only feature I will be looking for is how to disable it.
It rather involved being on the other side of this airtight hatchway.
The person quoted in the article says admin access isn't required and to bolster this gives an example of someone with admin access being able to access the recall database. I'm confused.