Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TotalRecall: Extracts and displays data from the Windows 11 Recall feature

github.com

Post reply on HN
Print view View original

71–80 of 98 posts

Re: TotalRecall: Extracts and displays data from the Windows 11 Recall feature

#71

Post by pseudalopex »

Dylan16807 wrote: post #67
lolinder wrote: post #59

Earlier quoted context omitted.

> How many people interpreted that claim as SCIF-equivalency? Basically everyone who isn't employed in tech? This is what the BBC said [0]: > And it said a would-be hacker would need to gain physical access to your device, unlock it and sign in before they could access saved screenshots. Those of us here can readily see that this "physical access" claim is bunk, but that's what Microsoft represented to the BBC and wh…

If it's just to prove those two words wrong, then this repo seems extremely overblown. "It works like every other program in the world" isn't very exploity. Also I don't think many people even saw or noticed that particular claim. They just saw the part about it saving everything you do to your computer and were rightfully worried.

> If it's just to prove those two words wrong, then this repo seems extremely overblown. "It works like every other program in the world" isn't very exploity.

The FAQ author explained it worked like every other program in the world. Some people doubted him because why wouldn't he show proof if it was so easy? The tool author called it a very simple tool and no rocket science whatsoever.

> Also I don't think many people even saw or noticed that particular claim.

Fewer people will see this repo. What is the correct number of people before misinformation should be corrected?

Re: TotalRecall: Extracts and displays data from the Windows 11 Recall feature

#72

Post by pseudalopex »

Dylan16807 wrote: post #63
pseudalopex wrote: post #57

Earlier quoted context omitted.

You interpreted a statement about saved screenshots in an article about Recall as a general claim about Windows security even the general public would know was false?

I guess I worded that badly. Let me try again: I interpreted that line as analogous to normal Windows security. As a general rule, a would-be hacker can't get to any of your on-device data, Recall included, without a local user giving them access. So the intent of the statement is to say it's immune to anything else being hacked, like servers. Not to say they finally invented a completely hack-proof system... and onl…

> As a general rule, a would-be hacker can't get to any of your on-device data, Recall included, without a local user giving them access.

Physical access means physical access to experts and the general public. Not physical access, social engineering, supply chain exploit, or remote code execution. Saying Windows can't be hacked without physical access would be false too.

> So the intent of the statement is to say it's immune to anything else being hacked, like servers.

Anything else would include Windows Update and Microsoft accounts.

They said Recall snapshots were stored on the PC itself and not available to Microsoft. Adding a misleading description of Windows security did nothing but confuse people.

Re: TotalRecall: Extracts and displays data from the Windows 11 Recall feature

#73

Post by pseudalopex »

poisonborz wrote: post #62
lolinder wrote: post #19

Security aside, I'm genuinely unsure what problem Recall is even meant to solve. Like most AI products and features announced over the past 18 months, it feels like a bunch of product people got into a meeting where they looked at the capabilities of the latest OpenAI model and then started spitballing feature ideas based not on user needs but on what GPTs can do. "Oh, these models can do OCR... why don't we screensh…

I think this is the feature everybody wants. Not in Windows, not from Microsoft, probably not yet, but it is so obvious and useful that I'm sure this will be a default thing for a future human. Imagine never forgetting anything. That tune, what your spouse told you to get, a meeting summary, recall or replay a dear memory. People _without_ this ability would be outliers and strangely left behind. I know there was a B…

> I know there was a Black Mirror on this, but imagine this to be safe, private, local, toggleable even.

Wasn't it private by default, local, and erasable in Black Mirror? And what does safe mean?

Re: TotalRecall: Extracts and displays data from the Windows 11 Recall feature

#74

Post by pseudalopex »

Dylan16807 wrote: post #65
pseudalopex wrote: post #60

Earlier quoted context omitted.

> Microsoft never even implied it wasn't locally accessible. BBC said Microsoft said a hacker would need physical access. You can think this meant to hack Recall or Windows.

Right. They specifically laid out a scenario where the data is locally accessible . So code that proves the data is locally accessible doesn't contradict them.

https://news.ycombinator.com/item?id=40579531

Re: TotalRecall: Extracts and displays data from the Windows 11 Recall feature

#75

Post by soganess »

poisonborz wrote: post #62
lolinder wrote: post #19

Security aside, I'm genuinely unsure what problem Recall is even meant to solve. Like most AI products and features announced over the past 18 months, it feels like a bunch of product people got into a meeting where they looked at the capabilities of the latest OpenAI model and then started spitballing feature ideas based not on user needs but on what GPTs can do. "Oh, these models can do OCR... why don't we screensh…

I think this is the feature everybody wants. Not in Windows, not from Microsoft, probably not yet, but it is so obvious and useful that I'm sure this will be a default thing for a future human. Imagine never forgetting anything. That tune, what your spouse told you to get, a meeting summary, recall or replay a dear memory. People _without_ this ability would be outliers and strangely left behind. I know there was a B…

I agree that it will super useful and can't wait for the OSS version of it on Linux that respects my privacy but only kinda does the same thing with a less useful LLM at its core.

That said, I wonder if general folks will see the toggling of this is the same way they initially did for incognito mode? Namely, that you would only use it to watch porn or do something nefarious. The classic "If you don't have anything to hide, why hide?" History has obviously proven that first impression as a rather reductive and silly one. Plus cultural norms/opinions around incognito mode are very neutral now.

Or if this will be like turning a bodycam off for cops? Imagine the distopia of a boss asking why you turned recall off for 30 minutes while you were on your lunchbreak...

I guess it is good that we have pocket supercomputers.

Re: TotalRecall: Extracts and displays data from the Windows 11 Recall feature

#76

Post by Dylan16807 »

pseudalopex wrote: post #74
Dylan16807 wrote: post #65

Earlier quoted context omitted.

Right. They specifically laid out a scenario where the data is locally accessible . So code that proves the data is locally accessible doesn't contradict them.

https://news.ycombinator.com/item?id=40579531

? That comment thread is about a completely different thing at this point.

Re: TotalRecall: Extracts and displays data from the Windows 11 Recall feature

#77

Post by whalesalad »

1234554321a wrote: post #70
whalesalad wrote: post #3

The movie poster for Total Recall hit a core memory. I am gonna need to re-watch that classic tonight.

This comment got downvoted because you’re about to watch a racist and problematic movie.

Uhh. What? I've never heard that before in my life. What am I missing?

Re: TotalRecall: Extracts and displays data from the Windows 11 Recall feature

#78

Post by Dylan16807 »

pseudalopex wrote: post #71
Dylan16807 wrote: post #67

Earlier quoted context omitted.

If it's just to prove those two words wrong, then this repo seems extremely overblown. "It works like every other program in the world" isn't very exploity. Also I don't think many people even saw or noticed that particular claim. They just saw the part about it saving everything you do to your computer and were rightfully worried.

> If it's just to prove those two words wrong, then this repo seems extremely overblown. "It works like every other program in the world" isn't very exploity. The FAQ author explained it worked like every other program in the world. Some people doubted him because why wouldn't he show proof if it was so easy? The tool author called it a very simple tool and no rocket science whatsoever. > Also I don't think many peop…

> The FAQ author explained it worked like every other program in the world. Some people doubted him because why wouldn't he show proof if it was so easy? The tool author called it a very simple tool and no rocket science whatsoever.

The repo overall makes it sound like it's a way bigger issue than that.

Re: TotalRecall: Extracts and displays data from the Windows 11 Recall feature

#79

Post by pseudalopex »

Dylan16807 wrote: post #76
pseudalopex wrote: post #74

Earlier quoted context omitted.

https://news.ycombinator.com/item?id=40579531

? That comment thread is about a completely different thing at this point.

I assumed your meaning of local was consistent across comments. Was it not?

Re: TotalRecall: Extracts and displays data from the Windows 11 Recall feature

#80

Post by pseudalopex »

smarx007 wrote: post #55
Dylan16807 wrote: post #52

Earlier quoted context omitted.

The BBC quote says "a would-be hacker". I interpreted that as a general claim about windows security, not saying that this particular feature is invisible to malware. They have to break the security of your particular device, the data is nowhere else.

> I interpreted that as a general claim about windows security Sure, because you understand that the other interpretation is nonsensical. All the publications that are popping up showing that the Recall DB is locally accessible are aimed at all the other Windows users. Now, I would fully agree if you question what's the benefit of posting this on GH and not on FB, for example, and what's in there to surprise the HN c…

> Now, I would fully agree if you question what's the benefit of posting this on GH and not on FB, for example, and what's in there to surprise the HN crowd.

The author posted Wired's article about the tool on LinkedIn. Does Facebook host code and render Markdown? Does the author have a Facebook account? Would you bet your Facebook account they wouldn't consider it distributing a hacking tool and lock the account?

Must it be surprising? Some in the HN crowd would want to explore their own databases I think. Some will have family and friends ask them about Recall security.

Post reply on HN