Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft to delay release of Recall AI feature on security concerns

reuters.com

Post reply on HN
Print view View original

341–350 of 485 posts

Re: Microsoft to delay release of Recall AI feature on security concerns

#341

Post by MrDrMcCoy »

999900000999 wrote: post #104
nimbius wrote: post #63

In summary: the only customers that matter --corporations paying site licenses-- declared this to be an unacceptable business risk. Anyone who is still using windows in 2024 and isnt a multinational business or llc gets what they deserve.

What if you can't afford a Mac, and you're not technically literate enough to install Ubuntu ? Speaking for myself, I dual boot mint and windows because I really like playing games and making music. Both of those are absolutely subpar on Linux. Outside of our nerd bubble, most normal people don't really want to run desktop Linux. Macs are great, but I can't really game on them.

I'm genuinely curious to hear an actual musician's take on the following Linux-compatible DAWs:

- Reaper

- Tracktion Waveform

- Bitwig

- Fairlight

- Zrythm

- Ardour

As for games, I've been 100% Linux for several years now, and haven't had much trouble. I'm only aware of issues with aggressive anticheat these days, but I refuse to give money to companies that push ring0-spyware anyway.

Re: Microsoft to delay release of Recall AI feature on security concerns

#342

Post by MrDrMcCoy »

jcfrei wrote: post #85
nimbius wrote: post #63

In summary: the only customers that matter --corporations paying site licenses-- declared this to be an unacceptable business risk. Anyone who is still using windows in 2024 and isnt a multinational business or llc gets what they deserve.

Not quite true: The other huge group of customers is simply gamers.

Gaming on Linux is pretty good now for games that don't demand ring0-spyware.

Re: Microsoft to delay release of Recall AI feature on security concerns

#343

Post by neltnerb »

sirspacey wrote: post #225
neltnerb wrote: post #108

Earlier quoted context omitted.

I do not think it is cynical to assume that Microsoft would sell this to companies as a way to do constant surveillance of their employees with OCR and LLMs used to make it easier for a manager to sift through massive amounts of data. That's just an actual use case that their true customers would pay for, I think it's awful and should be illegal under any reasonable worker protections but why would they not advertise…

You’ve got a point. Presuming you are correct, what do you think happens when the team has been culled? Union busting & screen tracking already works pretty well as is for the goals you’ve outline. We usually think about tracking/measurement as Big Brother looking over our shoulder, but all of us are living a day-to-day reality of losing context and having to invest a lot of effort and time to get it back (usually on…

> what do you think happens when the team has been culled?

I'm not quite sure what you mean, I see this as a long term trend that doesn't really have an end point.

There are always people that some manager wants to get rid of, for performance or unrelated reasons.

Employers are scared of getting sued for wrongful termination. Often they do it anyway, but then they need to make up a reason. They're decent at it already, but my prediction is that wrongful termination will become far more widespread and harder to detect or fight in court.

It won't stop though.

Re: Microsoft to delay release of Recall AI feature on security concerns

#344

Post by devjab »

simonw wrote: post #90
segasaturn wrote: post #65

Earlier quoted context omitted.

My takeaway is that Microsoft has been trying to boil the frog, but slipped and turned the temperature up too quickly. They're retreating for now, but make no mistake that Recall will slowly trickle back into Windows under another name. Every major power broker wants something like Recall to become the norm - bosses to spy on their employees, governments to spy on their citizens/enemies, and tech CEO's to collect tra…

This is a very cynical take. I've not seen anything to make me think this feature is intended for surveillance as opposed to personal utility. The personal utility benefits are very clear to me - the problem is the ease with which malicious attackers might steal the data (if they can breach the system).

I think you’re a little naive if you don’t think this will become handy tools for management. We view its potential as two-fold from a strictly non-employee-friendly side.

The monitoring abilities will be better than what is currently available. But it’s not really something a lot of organisations is going to be too interested in. Everyone already knows you’re spending a few hours each week doing internet things, maybe you’re even playing some digital board games with your coworkers. That’s fine (again, in most organisations), in good organisations you might even be able to play a little with your managers. What would be interesting isn’t the DDR type surveillance, it would be if the tools come with automatic detection for outliers. This would help you gather information on poor performers and maybe help them get better.

The other potential is much more sinister. At least if the tools work out as we expect they will. In that everyone will basically be training their AI replacements. This isn’t going to kill the office job, but it’ll make the processes where we’re already putting in more and more RPA smoother and more rapid. Microsoft being who they are, they will sell these tools of course, and if they keep up with their current pricing… well… let’s just say that having a student worker move data is cheaper than most of Microsoft’s current data automation, so we’ll…

As far as security goes I think this is more about complaisance than actual IT security. It’s frankly illegal to monitor employees the way these systems are intended to do in a lot of countries, and I’m not sure Microsoft really thought that true. If they roll out the current system in the EU then they are going to get a lot of attention from the big bureaucratic dragon. They probably will regardless of how they roll it out.

Re: Microsoft to delay release of Recall AI feature on security concerns

#345

Post by throwaway48476 »

simonw wrote: post #90
segasaturn wrote: post #65

Earlier quoted context omitted.

My takeaway is that Microsoft has been trying to boil the frog, but slipped and turned the temperature up too quickly. They're retreating for now, but make no mistake that Recall will slowly trickle back into Windows under another name. Every major power broker wants something like Recall to become the norm - bosses to spy on their employees, governments to spy on their citizens/enemies, and tech CEO's to collect tra…

This is a very cynical take. I've not seen anything to make me think this feature is intended for surveillance as opposed to personal utility. The personal utility benefits are very clear to me - the problem is the ease with which malicious attackers might steal the data (if they can breach the system).

I agree. If this feature was developed by someone not in the ad tech surveillance business and it ran on a secure by design operating system there would be a positive reaction.

Re: Microsoft to delay release of Recall AI feature on security concerns

#346

Post by 999900000999 »

MrDrMcCoy wrote: post #341
999900000999 wrote: post #104

Earlier quoted context omitted.

What if you can't afford a Mac, and you're not technically literate enough to install Ubuntu ? Speaking for myself, I dual boot mint and windows because I really like playing games and making music. Both of those are absolutely subpar on Linux. Outside of our nerd bubble, most normal people don't really want to run desktop Linux. Macs are great, but I can't really game on them.

I'm genuinely curious to hear an actual musician's take on the following Linux-compatible DAWs: - Reaper - Tracktion Waveform - Bitwig - Fairlight - Zrythm - Ardour As for games, I've been 100% Linux for several years now, and haven't had much trouble. I'm only aware of issues with aggressive anticheat these days, but I refuse to give money to companies that push ring0-spyware anyway.

I haven't used those tools, but Maschine, FL Studio, Akai's MPC(you can use it stand alone, but they heavily push the PC integration,) and Ableton are practically industry standards at this point.

You can make music on anything, I'd imagine a skilled producer could do anything I can do in Maschine in Zrythm. But it's a matter of difficulty.

Maschine has a series of custom midi instruments which are simply amazing.

As for gaming, you could probably play the next Call of Duty with browser based cloud gaming when it hits gamepass.

I definitely understand the benefits of Linux though. I think dual booting is the way to go.

Re: Microsoft to delay release of Recall AI feature on security concerns

#347

Post by throwaway48476 »

the_snooze wrote: post #141
dotps1 wrote: post #125

Earlier quoted context omitted.

I think the issue is more that nobody asked for it. These tools are useful, and on a Mac if you want Rewind, you have to know you want it, go out download it, pay for it, install it yourself .. and you knew what you were getting into the whole time. Having a tool like this planted in your device without your consent is pushing your userbase over the edge. If they made it a separate feature you had to manually install…

I think you hit the nail on the head. The feature itself can be benign and useful if Microsoft valued being respectful of user agency . Using Windows feels increasingly like a battle against against someone who can't accept "no" and tries to sneak around your intentions.

Along with Adobe recently it consensual business relationships are no longer common.

Re: Microsoft to delay release of Recall AI feature on security concerns

#348

Post by gerash »

The feature is great. It's not new idea. We were thinking of something like this 10 years ago on Android phones but the compute and battery life wasn't and still isn't there.

So I will use it if it's executed right. However I mainly use Linux and Mac these days.

Re: Microsoft to delay release of Recall AI feature on security concerns

#349

Post by Bognar »

consumer451 wrote: post #301
pjmlp wrote: post #296

Earlier quoted context omitted.

The whole issue is with Recall storage, and information gathering on Windows.

Yes, sorry, I had diverged upthread into the part where the CCP read the USA's gov emails. I can't get over that little tidbit.

Per Microsoft's write-up:

> Storm-0558 acquired an inactive MSA consumer signing key and used it to forge authentication tokens for Azure AD enterprise and MSA consumer to access OWA and Outlook.com. All MSA keys active prior to the incident – including the actor-acquired MSA signing key – have been invalidated. Azure AD keys were not impacted. The method by which the actor acquired the key is a matter of ongoing investigation. Though the key was intended only for MSA accounts, a validation issue allowed this key to be trusted for signing Azure AD tokens. This issue has been corrected.

So the attackers found a valid private key for MSA (undetermined how, the theory was that it was scraped from a debug dump that was moved from high privilege prod to someone's low privilege shared drive). They then used that key to sign invalid tokens for AAD and the validating side incorrectly accepted those tokens. In this case, the validating side would be Exchange / OWA. Azure AD seems to not be implicated in the security issues, since it was MSA that leaked the key and OWA that failed to properly validate it.

That's my interpretation of the text anyway. It also aligns with my own understanding from a brief time at MS that Azure is much better at security than the rest of MS and that Exchange is a dumpster fire because of decades of cruft and evolution of systems.

Re: Microsoft to delay release of Recall AI feature on security concerns

#350

Post by chucke1992 »

vsuperpower2020 wrote: post #149
red_admiral wrote: post #129

Earlier quoted context omitted.

As far as I know, a long while ago, the Islamic Republic of Iran asked Cisco to develop a filtering solution to stop their citizens from accessing undesirable content. Cisco said no. Then US companies started asking for filters to stop their employees watching porn at work, Cisco invented a centralised domain/packet filtering solution for their routers, and Iran went "can we buy one of those, please?". My take is tha…

When would this be useful? Microsoft's best examples are that the user forgot the location of a chinese food place your friend told you once.

For example you had some issue while developing the application, but you don't remember what parameters did you use to create this bug.

Or for example, you were reading some article but did not save it and now want to recall it.

Or maybe you watched some music clip or song on the some website and forgot the link to website.

A lot of use cases.

Post reply on HN