Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft will switch off Recall by default after security backlash

wired.com

Post reply on HN
Print view View original

121–130 of 572 posts

Re: Microsoft will switch off Recall by default after security backlash

#121

Post by Benedicht »

Analemma_ wrote: post #102
Tool_of_Society wrote: post #87

Earlier quoted context omitted.

Browser history doesn't show my passwords, everything I typed out and did on the machine. In comparison browser history is nothing.

You’re missing the point. An attacker can only see the passwords in your Recall database if they have root, but if they have root there are (and always have been) a thousand other ways they can get your passwords. There is no new attack vector being introduced by Recall.

If an attacker got root with recall they might not need to wait the user to type their password and risk detection. The information they want to know might be already in the recall database.

Re: Microsoft will switch off Recall by default after security backlash

#122

Post by red_admiral »

EGreg wrote: post #67
herf wrote: post #58

It's interesting to compare this to the Chrome/Safari/Edge browsing history, which is stored in an unencrypted SQLite database, and tracks what you do for the last 90 days. It's just a bit less visual, Incognito/Private modes work, and some users clear it more often. But a whole lot of the surveillance attacks people imagine about Recall apply just the same to the browser. I think it's the "little brother" casual att…

Browsing history doesn't contain what's displayed on the page, and what you input into the input boxes, or POST requests. It's sorta like telephone metadata. On the other hand, I am always freaked out by Chrome extensions that "can read and change your data on all websites ". Can't they have more granular permissions? You gotta have a lot of trust for those extensions LMAO. They can read your bank passwords, probably…

I have an extension like that called uBlock. If that ever gets compromised or sold, I will have much bigger problems ...

Re: Microsoft will switch off Recall by default after security backlash

#123

Post by neilv »

herf wrote: post #58

It's interesting to compare this to the Chrome/Safari/Edge browsing history, which is stored in an unencrypted SQLite database, and tracks what you do for the last 90 days. It's just a bit less visual, Incognito/Private modes work, and some users clear it more often. But a whole lot of the surveillance attacks people imagine about Recall apply just the same to the browser. I think it's the "little brother" casual att…

One difference is that Web browser history has been there 30 years, since before most people at the time had even touched a Web browser.

At the time, it wasn't very thinkable that someone would have the audacity to take and abuse that information.

It dates from when Internet people overall were more savvy about privacy than users overall today are, but it was also when the Internet was closer to a trustworthy environment, and before Wall Street sociopath types took over the tech and the culture.

Lots of kinds of abuse that today are routine and almost universal, for even startup tech companies, (e.g., embedding third-party trackers into Web site, and getting even worse from there), I think would've gotten them ostracized, and outraged demands for criminal charges.

During the dotcom gold rush, there was such a flood of totally new, posturing people, and so much money being thrown wildly at everything, that any remaining outrage was lost in the noise.

And now virtually no one knows any different.

But if you're trying to push some new abuse today, I think ordinary people are starting to have some awareness of what vicious sociopathic buttholes tech companies have become, and so acceptance might not be a slam-dunk.

Re: Microsoft will switch off Recall by default after security backlash

#124

Post by foxandmouse »

Do we know anything about Linux support for Snapdragon X.. Personally, I don't trust Qualcomm with Linux support. Their WiFi adapters don't work properly with Linux. Their mobile SoC that supposedly have mainline support only have the CPU part working, but GPU, modem, Bluetooth, etc. won't.

Also, wasn't their history of closed source drivers and their short support timeline was the reason Android devices only ever got 2 years of updates only a few years back?

Re: Microsoft will switch off Recall by default after security backlash

#125

Post by sseagull »

A4ET8a8uTh0 wrote: post #92
modeless wrote: post #73

It is puzzling to me that so many people seem to think this concept has no value. To me the concept is obviously good and something I have wanted for a long time. Of course the security of the implementation is important and I agree with some of the criticism there. But I see a lot of people arguing that the feature is worthless, or that it doesn't make sense at the OS level, or that Microsoft specifically should not…

Hmm. I think I can respond here. No one is really saying this feature has no value. For a user, there is value to being able to get to a previous point in time. That feature, however, is clearly not very well designed and implemented if it took days for it to be cracked on the internet for everyone to see. If I could trust that it STAYS local, maybe I would be less paranoid. But this is MS we are talking about. Perso…

> clearly not very well designed and implemented if it took days for it to be cracked on the internet for everyone to see

I really don't understand this line of thinking. What was cracked? That the database is readable, unencrypted? How could it be encrypted and usable at the same time?

> If I could trust that it STAYS local

This I agree with. While it's local now, not trusting MS is a valid belief, given their past behavior. If they feel sending some of the info to the cloud could get them $$$, then they will do it. Although I feel regulators might be pretty quick on this one...

Re: Microsoft will switch off Recall by default after security backlash

#126

Post by SavageBeast »

In all the MS Recall drama, I've yet to hear or read one single person utter something to the effect of "Wow - great!!! - I've been waiting for something like this for years! This will solve at least one of the major issues I face regularly!". In fact, it seems to me the only people that really want this feature are the ones trying to push it down everyones collective throat. Why is MS pushing something so hard when nobody asked for it?

Re: Microsoft will switch off Recall by default after security backlash

#127

Post by ffhhj »

mackrevinack wrote: post #118

make it a separate program that people can install if they want to. if its really that great then people will download it

And how are they going to convince people to be surveilled voluntarily? This needs to be behind a switch they can silently enable in some update, ofcourse.

Re: Microsoft will switch off Recall by default after security backlash

#128

Post by sanktanglia »

Tool_of_Society wrote: post #87
Analemma_ wrote: post #68

Earlier quoted context omitted.

Yeah, I think this entire debate is uninformed hysteria and manufactured outrage. "If an attacker has administrator access, they can see everything you have done on your computer!". OK? That has literally always been the case? "Attacker is root" is game over and always has been. The original writeup from DoublePulsar tried to justify that Recall is somehow different from other such scenarios, but I found it totally u…

Browser history doesn't show my passwords, everything I typed out and did on the machine. In comparison browser history is nothing.

You can get cookies/tokens from chrome databases so its the equivalent to passwords in alot of cases

Re: Microsoft will switch off Recall by default after security backlash

#129

Post by drexlspivey »

ndiddy wrote: post #71
paxys wrote: post #28

Earlier quoted context omitted.

What would prevent a virus from directly stealing the data it wants without going through this feature?

Without Recall, an attacker needs to get a program to stay resident in memory to log keystrokes, screen contents, etc. for an extended period of time without getting detected. With Recall, they can get the same end effect by exfiltrating the Recall database file whenever it's convenient (i.e. an infected version of a text editor could send it while pretending to check for updates). This significantly lowers the barri…

> Without Recall, an attacker needs to get a program to stay resident in memory to log keystrokes, screen contents, etc

Or it could just steal your cookies which are out there in the open.

Re: Microsoft will switch off Recall by default after security backlash

#130

Post by riscy »

dylan604 wrote: post #84
danielcampos93 wrote: post #36

This seems to be a feature that execs wanted, and people find creepy, and no one has the gumption to push back on the exec request.

How can you have the number of employees they do and not have a single non-sychophant employee?

The layer of management reporting to leadership are yes-men.
Post reply on HN