Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft will switch off Recall by default after security backlash

wired.com

Post reply on HN
Print view View original

421–430 of 572 posts

Re: Microsoft will switch off Recall by default after security backlash

#421

Post by EGreg »

ls612 wrote: post #338
EGreg wrote: post #250

Earlier quoted context omitted.

Seems like a very juicy target. These extensions should not store any data without a master password that you input every time. What if someone stole the signing key, and submitted an update to Chrome store, even for a little? Oh wait that is only for Chrome Apps. For extensions, they can literally update themselves anytime. Someone would just have to steal the certificate. If an extension that reads all data uses a…

>Oh wait that is only for Chrome Apps. For extensions, they can literally update themselves anytime. Someone would just have to steal the certificate. Mozilla reviews signed extension updates. Something tells me uBO is one of the most scrutinized given how very many users it has. >If an extension that reads all data uses a CDN (like CloudFlare) that CDN can execute a MITM attack against it and download new code, that…

Extensions can simply download and update their own code, eg by loading new stuff from localStorage.

I have seen Metamask update itself randomly, and it has access to read every website

Re: Microsoft will switch off Recall by default after security backlash

#422

Post by powersnail »

nottorp wrote: post #216
byteknight wrote: post #117

Earlier quoted context omitted.

This is a horrible comparison. Browsing history doesnt show the contents of the page. It doesnt show you what you were doing on that page. It doesn't reveal anything other than you went there and maybe how long.

Well, on old school sites where there are static pages each pointed to by an unique url, yes it does show the contents of the page :)

Publicly available content, yes. But not the content entered by the user themselves (security question answers, for example), and not contents behind a login, which is usually the case for sensitive information. Screenshots capture them all.

Re: Microsoft will switch off Recall by default after security backlash

#423

Post by RajT88 »

bc_programming wrote: post #373
RajT88 wrote: post #347

Earlier quoted context omitted.

There used to be no option to uninstall it - now there is. You will still get it reinstalled during a major OS update, but at least it can easily be removed. Before it was a chore to clean up. I would speculate there is even some way to prevent it from reinstalling during those major updates. That seems like the kind of capability they would build in because a huge Windows customer complained (i.e. realistically, the…

Not quite what you are describing, but you can prevent any specific executable from ever running by configuring a "debugger" for it in Image File Execution options (HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options). You add a key with the executable name and then add a "debugger" value, then point that debugger at C:\Windows\system32\systray.exe. Every time the named execut…

You can also define software restriction policies to do similar things.

It id what SRP's are for (but yes, I would not put it past them to disable anything targeting OneDrive).

Re: Microsoft will switch off Recall by default after security backlash

#424

Post by Slyfox33 »

cesarb wrote: post #253
rchaud wrote: post #137

Earlier quoted context omitted.

I've heard Microsoft wants to do away with on-device Windows entirely for consumer devices, and go with a "dumb client" form factor that is always connected to a remote Windows server. I'm not sure who at the org is pushing for this as it would essentially hand the PC games market to SteamOS. I suppose they saw how well it's worked for enterprise customers that essentially already use a Windows VM through Citrix or s…

> I'm not sure who at the org is pushing for this as it would essentially hand the PC games market to SteamOS. PC games can already be played on a remote server, using services like Stadia, so it would not necessarily hand the PC games market to local Linux-based devices running SteamOS (like the Steam Deck).

Stadia? That got shut down years ago.

Re: Microsoft will switch off Recall by default after security backlash

#425

Post by jasonfarnon »

pydry wrote: post #223
SketchySeaBeast wrote: post #189

Earlier quoted context omitted.

I think they actually did consider that - that's why they emphasized it was all on device. They thought about it, they just didn't think about how little we would trust that promise.

I'm perplexed that anybody thinks Microsoft were being dumb. They know exactly what they are doing and putting the pieces in place to violate users' security is the point. Theyre just boiling the frog slowly. It'll be turned on by default soon enough and then theyll start looking for excuses to upload it. This can be used to make them a shedload of money one day.

I agree, these decisions in 2024 are thoroughly vetted. I think the only thing these companies don't know is when the news cycle will pick up on something they're doing and they get blowback, and they'll have to pretend this was some little oversight.

Re: Microsoft will switch off Recall by default after security backlash

#426

Post by haswell »

wvenable wrote: post #411
haswell wrote: post #393

Earlier quoted context omitted.

"Old" is a bit of a stretch here ;) But I'm glad to hear they've committed to making changes. Given the misrepresentations they made regarding the initial rollout plan (the target of most criticism, mine included), Microsoft has to prove themselves here and I'll wait until qualified security folks get their hands on this before coming to any conclusions. What we know is that the initial version was a non-starter, and…

Well it is "old" since the article is about Microsoft's blog post where they discuss all these changes! https://blogs.windows.com/windowsexperience/2024/06/07/updat... > It remains baffling and worrisome that it took a public outcry for them to implement what sounds like a baseline level of acceptable protection. It's possible this was the intention all along but as a early-beta feature this was just the MVP. The rea…

> It's possible this was the intention all along ... to get feedback

If they're relying on public feedback to realize how completely unacceptable the initial rollout was, that again points to deep problems at Microsoft and is why I'm saying this is baffling.

Re: Microsoft will switch off Recall by default after security backlash

#427

Post by 627467 »

consumer451 wrote: post #416

When Recall is enabled, it should have an overlay stating that it is active so that all users are aware. Something at least as obvious as the old Windows activation overlay.[0] Otherwise, every creepy roommate, bad partner, bad friend, etc... will take advantage of this to do bad things. [0] Ideally more obvious, like when Windows screen recording is running.

How is this different from having screen recording on?

Re: Microsoft will switch off Recall by default after security backlash

#428

Post by consumer451 »

627467 wrote: post #427
consumer451 wrote: post #416

When Recall is enabled, it should have an overlay stating that it is active so that all users are aware. Something at least as obvious as the old Windows activation overlay.[0] Otherwise, every creepy roommate, bad partner, bad friend, etc... will take advantage of this to do bad things. [0] Ideally more obvious, like when Windows screen recording is running.

How is this different from having screen recording on?

If you mean Win-G, then clicking screen record, it shows an overlay which clearly indicates that the screen is being recorded. I don't think that you can hide that overlay.

Re: Microsoft will switch off Recall by default after security backlash

#429

Post by noagainlate »

627467 wrote: post #427
consumer451 wrote: post #416

When Recall is enabled, it should have an overlay stating that it is active so that all users are aware. Something at least as obvious as the old Windows activation overlay.[0] Otherwise, every creepy roommate, bad partner, bad friend, etc... will take advantage of this to do bad things. [0] Ideally more obvious, like when Windows screen recording is running.

How is this different from having screen recording on?

there's a giant banner saying that screen recording is on, while there's nothing for recall? im not sure im following your question.

Re: Microsoft will switch off Recall by default after security backlash

#430

Post by BoredPositron »

giobox wrote: post #283
axus wrote: post #113

Earlier quoted context omitted.

It's analogous to phone call metadata vs. the contents of the phone calls.

Perhaps. A key difference though - history files can include the individual pages I requested from the same host. Right now I have like 50 entries for the various posts I read just from HackerNews, all as separate line items etc etc. In the case of the phone, one simply sees recipient of call, duration etc, regardless of how much information was exchanged. The phone I'm calling is arguably analogous to the server I r…

It won't save your passwords in clear text though.
Post reply on HN