Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft will switch off Recall by default after security backlash

wired.com

Post reply on HN
Print view View original

271–280 of 572 posts

Re: Microsoft will switch off Recall by default after security backlash

#271

Post by soared »

atribecalledqst wrote: post #260

Maybe a bit off-topic, but I sure wish they'd do this for OneDrive! I installed Windows for personal use for the first time recently (although I use it exclusively at work) and it drove me ABSOLUTELY BONKERS that my home drive was mapping to C:\Users\atribecalledqst\OneDrive. What I hated the most was that the File Explorer just calls the folders in there e.g. "Documents" and "Pictures" without showing the full path.…

I just got a new PC and went through the same thing! Incredibly frustrating that in something Godot I have to manually traverse through folders to get to where I want to actually save a file (like.. Documents)

Re: Microsoft will switch off Recall by default after security backlash

#272

Post by jandrese »

atribecalledqst wrote: post #260

Maybe a bit off-topic, but I sure wish they'd do this for OneDrive! I installed Windows for personal use for the first time recently (although I use it exclusively at work) and it drove me ABSOLUTELY BONKERS that my home drive was mapping to C:\Users\atribecalledqst\OneDrive. What I hated the most was that the File Explorer just calls the folders in there e.g. "Documents" and "Pictures" without showing the full path.…

Dear OS writers:

Internet access is not always guaranteed or reliable. Please do not assume that the cloud is a viable solution for every user.

I ran into this on my phone awhile back. I knew I would be out of service for some time but had some PDFs I needed to reference. So I downloaded them to "files". Que surprise when I later go to look up a value and there's a little cloud with a down arrow button next to the PDF in the files app, which of course fails because I'm nowhere near any internet access. Even more fun: turning off the cloud integration in files just causes the files to disappear, even if you are currently connected. It's allergic to local storage.

Re: Microsoft will switch off Recall by default after security backlash

#273

Post by dragonwriter »

thaumasiotes wrote: post #240
GordonS wrote: post #110

Earlier quoted context omitted.

Your browsing history is unlikely to contain personal information, secrets, porn images etc. And if you use Chrome, they get your full browsing history by default. I get your point, but Microsoft's Recall can capture anything onscreen - emails, personal info, porn, passwords and the like. And it feels, bizarrely for 2024, that little thought has gone into privacy or security.

> Your browsing history is unlikely to contain [...] porn images Of all the places on your computer that might contain porn images, that would be one of the very top candidates.

No, the browsing history isn't likely to (data URLs I guess make it technically possible, but...); your browser cache might.

Re: Microsoft will switch off Recall by default after security backlash

#274

Post by musictubes »

sseagull wrote: post #196
A4ET8a8uTh0 wrote: post #174

Earlier quoted context omitted.

I am admittedly mildly confused by this response. Do online portals typically use unencrypted passwords? Do they let data flow unecrypted? Are those portals somehow unusable? Could you elaborate a little bit? It is possible I am misunderstanding your point.

I have only been somewhat paying attention, but there were lots of stories about someone "cracking" the implementation of Recall and getting access to the locally-stored database. The criticism is that it is easily accessible, but it's hard for me to imagine it any other way and have it still be useful. It's still encrypted at rest, but must be unencrypted for data to be written to it. There is plenty to criticize ab…

I have also only been skimming the info but the issues seem to be:

1) Recall takes snapshots of user’s activity and then copilot analyses it and keep the info in a plain text database.

2) The database is accessible to other accounts in the same computer.

3) The database is kept very small in order to save storage space. The trouble is that it is so small that it takes no time at all to upload it. One researcher infected his machine with a know piece of malware. By the time the AV software recognized it the database had already been sent.

4) Oncenthe database is in hand it is trivial to see whatever the person was working on and what information was involved. Apparently you can literally see some things.

So yeah, collecting large amounts of sensitive data makes for a very juicy target.

Re: Microsoft will switch off Recall by default after security backlash

#276

Post by [deleted] »

wing-_-nuts wrote: post #142
SavageBeast wrote: post #126

In all the MS Recall drama, I've yet to hear or read one single person utter something to the effect of "Wow - great!!! - I've been waiting for something like this for years! This will solve at least one of the major issues I face regularly!". In fact, it seems to me the only people that really want this feature are the ones trying to push it down everyones collective throat. Why is MS pushing something so hard when…

When this was announced I actually saw a post by someone who used a similar tool for time tracking in OS X and they claimed it was really helpful. To be frank, I would not mind having this feature on linux provided it was entirely local, and encrypted .

[deleted]

Re: Microsoft will switch off Recall by default after security backlash

#277

Post by downrightmike »

nerdjon wrote: post #6

Will have to wait and see if the extra security measures actually improve anything or not. However regarding it being opt out… what would prevent a virus from just enabling it on a bunch of machines silently. Sure it would be caught but the damage done and most won’t be bothered to go in and disable it after. Or Microsoft just decides they need to really market the hell out of AI and it gets turned on my default anyw…

They can't even do their own infra securely, or did you forget a advanced persistent threat entity was in their system and minting certs to access all of azure recently?

Re: Microsoft will switch off Recall by default after security backlash

#278

Post by smaudet »

Analemma_ wrote: post #102
Tool_of_Society wrote: post #87

Earlier quoted context omitted.

Browser history doesn't show my passwords, everything I typed out and did on the machine. In comparison browser history is nothing.

You’re missing the point. An attacker can only see the passwords in your Recall database if they have root, but if they have root there are (and always have been) a thousand other ways they can get your passwords. There is no new attack vector being introduced by Recall.

Another big, big difference, anybody, not just some black-hat pro with a long kill chain of zero-days, has a fantastic source of data to exfiltrate.

Perhaps you didn't note before, or are one yourself, but this includes e.g. abusive spouses. Sure, maybe the abusive spouse could hire a black hat, but this is very different to a drunk low-life wife-beater casually snooping through "recall".

It might not be a "new" attack vector, but its absolutely a complete degradation to any computer security.

Re: Microsoft will switch off Recall by default after security backlash

#279

Post by unpixer »

jonny_eh wrote: post #98
dylan604 wrote: post #83

Earlier quoted context omitted.

"Total Recall" in quotes makes me think you're trying to get your ass back to Mars and that you're trying to remember something because you had your memories wiped. It makes me think of nothing about a friendly service being offered forcefully upon you from your friendly and malevolent OS provider.

It's a story about false memories, and how that can change your identity. Regardless, it's the first thing I thought of when I heard about the feature.

The Philip K. Dick short story was a direct inspiration for the Paul Verhoeven movie starring Arnold Schwarzenegger, as it happens.

Re: Microsoft will switch off Recall by default after security backlash

#280

Post by emeril »

atribecalledqst wrote: post #260

Maybe a bit off-topic, but I sure wish they'd do this for OneDrive! I installed Windows for personal use for the first time recently (although I use it exclusively at work) and it drove me ABSOLUTELY BONKERS that my home drive was mapping to C:\Users\atribecalledqst\OneDrive. What I hated the most was that the File Explorer just calls the folders in there e.g. "Documents" and "Pictures" without showing the full path.…

you just have to use dopus as a file explorer replacement and just use dropbox (with cryptomator of course...) to yield (in most respects) best in class file management and sync
Post reply on HN