Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft Research chief scientist has no issue with Recall

theregister.com

Post reply on HN
Print view View original

31–40 of 91 posts

Re: Microsoft Research chief scientist has no issue with Recall

#31

Post by bsmartt »

i dont understand why everyone is so confused and outraged. first off, it doesnt affect you. even if you do buy a microsoft laptop that is being marketed as the "ai powered technology revolotion" (or whatever), its shipping from the start with almost all the tools i can think of to help you only recall what you want. application exclusion by ifn, pause the stored data / purge stored data / or opt out forever. if you use edge, you can have it ignore incognito tabs or certain websites. The feature needs to be opt in without these restrictions set up because the people who might actually benefit here are people who don't want to be bothered with those power user features. like my grandma.

anyone who is worried about screenshots leaking, do you guys remember photoshop?

we already have keyloggers, banking trojans, infostealers, and for someone to access your recall screenshots they'll be in a position to infect your laptop with all the usual suspects in commodity malware. so they could start logging your keystrokes, pilfer your chrome browsing data, or they could start downloading a 25 GB file that they can't even decrypt, and (lets just allow them to decrpyt somehow). now they get the pleasure of looking through 25 gb of cat pics and reddit hoping they might find a picture of you logging into your bank where you toggle the show password field button. or maybe you don't ever reveal the password so he gets really mad because his ISP only gives him 30GB down / month and he just burned nearly all of it. he decides to dox you and your data, but there isnt anything connecting your real identity to these screenshots (which again, couldve been photoshopped, or you could create your win11 username as Sam Altman). And none of this is even going to happen this would be the first time ive ever heard of a hands on keyboard commodity malware controller who is targeting whomever he can breach and rather than just sitting back while keyloggers and bots phone home and exfil sensitive data as text in an automated way, he's at home dealing with these massive encrpyted archive files and bajillions of screenshots.

everyone be triflin' over some bullshit here, you guys know why they did this right, not because its useful or a good use of AI. all the big guys are racing to cash in on the consumer AI market and they want to tell wall st on the quarterly earnings reports that theyve got a new go to market strategy with AI and its going to lead to N revenue, and instead of slightly faster hardware the next surface launch is gonna be huge marketing event and if you guys in nyc want to bet on ai for consumers, buy more microsoft stock.

isnt this obvious my friends?

Re: Microsoft Research chief scientist has no issue with Recall

#33

Post by worthless-trash »

bsmartt wrote: post #18
leokennis wrote: post #13

My understanding is that the Recall database is basically a plaintext local sqlite DB, and the only security measure is that it is stored in a folder for which you need admin rights to access? If so, how is that excusable for a company like Microsoft? I'd say even a weekend hackathon project would implement more security than that?

where did you hear that? > Snapshots are encrypted by Device Encryption or BitLocker, which are enabled by default on Windows 11. Recall doesn't share snapshots with other users that are signed into Windows on the same device. Microsoft can't access or view the snapshots. You can delete your snapshots at any time by going to Settings > Privacy & security > Recall & snapshots on your PC. source: https://support.micros…

> Microsoft can't access or view the snapshots.

And yet..

> Q. So how does it work?

> A. Every few seconds, screenshots are taken. These are automatically OCR’d by Azure AI, running on your device, and written into an SQLite database in the user’s folder.

Heads up, Microsoft runs azure. They likely get it before the local users database does.

Re: Microsoft Research chief scientist has no issue with Recall

#34

Post by WhackyIdeas »

bsmartt wrote: post #31

i dont understand why everyone is so confused and outraged. first off, it doesnt affect you. even if you do buy a microsoft laptop that is being marketed as the "ai powered technology revolotion" (or whatever), its shipping from the start with almost all the tools i can think of to help you only recall what you want. application exclusion by ifn, pause the stored data / purge stored data / or opt out forever. if you…

To think it’s purely money is utterly naive. It’s surveillance tech for the NSA which ALSO makes Microsoft a packet.

Re: Microsoft Research chief scientist has no issue with Recall

#35

Post by bsmartt »

leokennis wrote: post #19
bsmartt wrote: post #18

Earlier quoted context omitted.

where did you hear that? > Snapshots are encrypted by Device Encryption or BitLocker, which are enabled by default on Windows 11. Recall doesn't share snapshots with other users that are signed into Windows on the same device. Microsoft can't access or view the snapshots. You can delete your snapshots at any time by going to Settings > Privacy & security > Recall & snapshots on your PC. source: https://support.micros…

Some excerpts from https://doublepulsar.com/recall-stealing-everything-youve-ev... : ---------- Q. So how does it work? A. Every few seconds, screenshots are taken. These are automatically OCR’d by Azure AI, running on your device, and written into an SQLite database in the user’s folder. This database file has a record of everything you’ve ever viewed on your PC in plain text. OCR is a process of looking an image, a…

so official microsoft documentation vs infosec twitter.

that's not how you back up an argument with proof. there are no microsoft engineers in that video. i see a laptop. is that from tiktok? how are you taking this guy's word for shit without even thinking? its like 13 seconds taken out of context showing a folder click and authorization (what's even happening here, is this an admin account?)

Re: Microsoft Research chief scientist has no issue with Recall

#36

Post by rmm »

timeon wrote: post #26
rmm wrote: post #9

Privacy/security issues aside. It’s a really freaken useful tool that I’m already missing on other devices.

Convenience yet again shows it will be downfall of humanity.

I know. I know. Im hoping they secure it somehow without crippling it.

But honestly, it’s like it was designed for the way I work. I dont have a trillion tabs open any more.

I run multiple projects at once plus personal stuff throughout the day. Really really poor project management. But now I just go about what I’m doing and can pickup where I left off.

Literal use case: I was writing a report for a client and had done a bunch of research on a topic, then got distracted as I remembered I needed to upgrade the homelab and wanted new unifi gear. Then got back on another project where I needed provide a summary of similar other projects we had worked on.

So after I finished the last task, I quickly pulled up the research where and where I was at, it even found items I didn’t notice initially. Then at a day later I was able to pull up all the spec sites, reddit posts and recommendations and shopping sites I found for the cheapest place to buy my new gear.

It was awesome.

And that’s one of many many times it saved me.

Re: Microsoft Research chief scientist has no issue with Recall

#37

Post by barrkel »

ankurdhama wrote: post #30

The whole drama around with how Recall store data is misguided. The problem is not how this data is stored, it is more fundamental i.e how windows doesn't have a proper app sand boxing. MS App store apps have sandboxing and permission model but most of other apps on windows are still just bunch of DLLs and EXEs that run with all the permissions that the current user have. Until MS solves this problem there is no way…

I don't want to run an operating system where I need to get the vendor's permission to run my own applications under my authority.

Re: Microsoft Research chief scientist has no issue with Recall

#38

Post by WhackyIdeas »

kvaneijk wrote: post #3

We've launched a FOSS alternative with OpenRecall https://github.com/openrecall/openrecall to (hopefully) work towards addressing some of the concerns people have with Windows Recall. We think it could be a useful feature but it must be (1) fully auditable/open source (2) using open source local models (3) focused on privacy/security and (4) hardware/OS independent. We're working out the roadmap currently so any feed…

No I won’t be installing your keylogger.

Re: Microsoft Research chief scientist has no issue with Recall

#39

Post by mvdtnz »

ankurdhama wrote: post #30

The whole drama around with how Recall store data is misguided. The problem is not how this data is stored, it is more fundamental i.e how windows doesn't have a proper app sand boxing. MS App store apps have sandboxing and permission model but most of other apps on windows are still just bunch of DLLs and EXEs that run with all the permissions that the current user have. Until MS solves this problem there is no way…

As a user and programmer - good. Sandboxing is what is ruining modern software. I want to be able to reach into my file system with software. I want software to be able to integrate with other software even if those programs don't have APIs or weren't designed for integration. I want to be able to easily install mods for games. Most of all I don't want to manage annoying permissions screens and popups for every non trivial interaction. My computer, my choice.

Re: Microsoft Research chief scientist has no issue with Recall

#40

Post by Kototama »

barrkel wrote: post #37
ankurdhama wrote: post #30

The whole drama around with how Recall store data is misguided. The problem is not how this data is stored, it is more fundamental i.e how windows doesn't have a proper app sand boxing. MS App store apps have sandboxing and permission model but most of other apps on windows are still just bunch of DLLs and EXEs that run with all the permissions that the current user have. Until MS solves this problem there is no way…

I don't want to run an operating system where I need to get the vendor's permission to run my own applications under my authority.

This is not correlated. Android has sandboxing and you can run your own applications.
Post reply on HN