Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft Research chief scientist has no issue with Recall

theregister.com

Post reply on HN
Print view View original

21–30 of 91 posts

Re: Microsoft Research chief scientist has no issue with Recall

#21

Post by leokennis »

rcxdude wrote: post #20
leokennis wrote: post #13

My understanding is that the Recall database is basically a plaintext local sqlite DB, and the only security measure is that it is stored in a folder for which you need admin rights to access? If so, how is that excusable for a company like Microsoft? I'd say even a weekend hackathon project would implement more security than that?

What further security measures were you imagining? full-disk encryption is now standard in windows 11. So how would you secure the database further from a user with admin rights?

At least encrypt the database records, so if someone steals your sqlite data they don't automatically know what you were doing on your pc.

Re: Microsoft Research chief scientist has no issue with Recall

#22

Post by whilenot-dev »

kvaneijk wrote: post #3

We've launched a FOSS alternative with OpenRecall https://github.com/openrecall/openrecall to (hopefully) work towards addressing some of the concerns people have with Windows Recall. We think it could be a useful feature but it must be (1) fully auditable/open source (2) using open source local models (3) focused on privacy/security and (4) hardware/OS independent. We're working out the roadmap currently so any feed…

I'm sorry to be that guy, but capturing screenshots is anything but "focused on privacy/security".

It should be either:

- browser only and semantically understand and hide sensitive information like password fields (or even all input fields)

- or capture stuff from the display server and make it configurable which applications should be ignored (e.g. password manager), and even prompt with each newly opened window if the user wants to remember that session

...and that's just the basics, if we go into details I'm sure there's much more to it.

Re: Microsoft Research chief scientist has no issue with Recall

#23

Post by metafunctor »

leokennis wrote: post #21
rcxdude wrote: post #20

Earlier quoted context omitted.

What further security measures were you imagining? full-disk encryption is now standard in windows 11. So how would you secure the database further from a user with admin rights?

At least encrypt the database records, so if someone steals your sqlite data they don't automatically know what you were doing on your pc.

If they can get your sqlite files, what makes you think they wouldn't be able to get the encryption key as well?

Re: Microsoft Research chief scientist has no issue with Recall

#24

Post by [deleted] »

leokennis wrote: post #21
rcxdude wrote: post #20

Earlier quoted context omitted.

What further security measures were you imagining? full-disk encryption is now standard in windows 11. So how would you secure the database further from a user with admin rights?

At least encrypt the database records, so if someone steals your sqlite data they don't automatically know what you were doing on your pc.

[deleted]

Re: Microsoft Research chief scientist has no issue with Recall

#25

Post by maven29 »

leokennis wrote: post #21
rcxdude wrote: post #20

Earlier quoted context omitted.

What further security measures were you imagining? full-disk encryption is now standard in windows 11. So how would you secure the database further from a user with admin rights?

At least encrypt the database records, so if someone steals your sqlite data they don't automatically know what you were doing on your pc.

Might as well steal your sessions if they had that kind of access. MFA bypass is a lot more valuable than petty blackmail.

Re: Microsoft Research chief scientist has no issue with Recall

#27

Post by irthomasthomas »

fossr wrote: post #6
CodeCompost wrote: post #4

Earlier quoted context omitted.

Why would I want this?

Some people think it coukd genuinely be a useful feature, just like you can rewind your TV or a live stream to go back. It should really be open source however to be auditable for anyone.

Others find value in forgetting.

Re: Microsoft Research chief scientist has no issue with Recall

#28

Post by rightbyte »

leokennis wrote: post #19
bsmartt wrote: post #18

Earlier quoted context omitted.

where did you hear that? > Snapshots are encrypted by Device Encryption or BitLocker, which are enabled by default on Windows 11. Recall doesn't share snapshots with other users that are signed into Windows on the same device. Microsoft can't access or view the snapshots. You can delete your snapshots at any time by going to Settings > Privacy & security > Recall & snapshots on your PC. source: https://support.micros…

Some excerpts from https://doublepulsar.com/recall-stealing-everything-youve-ev... : ---------- Q. So how does it work? A. Every few seconds, screenshots are taken. These are automatically OCR’d by Azure AI, running on your device, and written into an SQLite database in the user’s folder. This database file has a record of everything you’ve ever viewed on your PC in plain text. OCR is a process of looking an image, a…

Oh dear. This sounds terrible from a privacy and security standpoint. Secret passwords where you press the "eye button", sensitive info ...

Re: Microsoft Research chief scientist has no issue with Recall

#30

Post by ankurdhama »

The whole drama around with how Recall store data is misguided. The problem is not how this data is stored, it is more fundamental i.e how windows doesn't have a proper app sand boxing. MS App store apps have sandboxing and permission model but most of other apps on windows are still just bunch of DLLs and EXEs that run with all the permissions that the current user have. Until MS solves this problem there is no way to secure such things.
Post reply on HN