Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TotalRecall: Extracts and displays data from the Windows 11 Recall feature

github.com

Post reply on HN
Print view View original

51–60 of 98 posts

Re: TotalRecall: Extracts and displays data from the Windows 11 Recall feature

#51

Post by smarx007 »

planb wrote: post #45
lolinder wrote: post #31

Earlier quoted context omitted.

> isn’t providing a photographic memory of everything you do on your PC exactly what this is supposed to do? Yes, but look at the Q&A at the bottom: apparently Microsoft told the BBC that hackers would have to have physical access to the device in order to access the data. This repo proves that's nonsense because all an attacker would have to do is install this code on your computer, which is something we already kno…

So MS lied in an interview. Or the press person was not very knowledgeable. But how would that even work, that data can only be accessed locally? How does a computer decide if the intent to access a file is coming from the user in front of the PC or from someone who installed malware that sends keystrokes or mouse clicks on behalf of the user?

https://doublepulsar.com/recall-stealing-everything-youve-ev...

Apple maintains some databases on macOS that are not sudo-accessible.

Re: TotalRecall: Extracts and displays data from the Windows 11 Recall feature

#52

Post by Dylan16807 »

smarx007 wrote: post #47
Dylan16807 wrote: post #32

Earlier quoted context omitted.

Where's the disproof of that? Am I missing something? "this is wrong" is not a sufficient counterargument.

The repo is along the lines of "2+2=4". GP said there is nothing interesting in that, to which I pointed to the QnA entry which shows that MS did tell a journalist that "2+2=22", so to speak. What else is there to disprove? The significance of the repo is not to show 2+2=4 but that 2+2 != 22

The BBC quote says "a would-be hacker". I interpreted that as a general claim about windows security, not saying that this particular feature is invisible to malware. They have to break the security of your particular device, the data is nowhere else.

Re: TotalRecall: Extracts and displays data from the Windows 11 Recall feature

#53

Post by pseudalopex »

planb wrote: post #49
croes wrote: post #37

Earlier quoted context omitted.

It's more than just browser history. What if the screenshot that is safed is taken while you have a password in plain sight? Companies will use it to check on their employees. Hackers will get material to extort you. "Interesting porn you watched three weeks ago". No need to caught you in the act. It's enough to get access some time later. Abusers can control their partners.

When do you have a password in plain sight? On the other hand, a key logger that extracts the passphrase for my password manager and steals the database file of it would be a disaster. I’d rather have an attacker browse through years of screenshots.

> When do you have a password in plain sight?

When I generate a new password.

Re: TotalRecall: Extracts and displays data from the Windows 11 Recall feature

#54

Post by hypeatei »

planb wrote: post #49
croes wrote: post #37

Earlier quoted context omitted.

It's more than just browser history. What if the screenshot that is safed is taken while you have a password in plain sight? Companies will use it to check on their employees. Hackers will get material to extort you. "Interesting porn you watched three weeks ago". No need to caught you in the act. It's enough to get access some time later. Abusers can control their partners.

When do you have a password in plain sight? On the other hand, a key logger that extracts the passphrase for my password manager and steals the database file of it would be a disaster. I’d rather have an attacker browse through years of screenshots.

Recall is just a massive trove of data and there is no single way it can be abused. For example, key loggers are extremely noisy (bunch of keystrokes being dumped into a log) and an attacker could use the data to see when the last time the user logged into their password manager was to narrow down the search.

Re: TotalRecall: Extracts and displays data from the Windows 11 Recall feature

#55

Post by smarx007 »

Dylan16807 wrote: post #52
smarx007 wrote: post #47

Earlier quoted context omitted.

The repo is along the lines of "2+2=4". GP said there is nothing interesting in that, to which I pointed to the QnA entry which shows that MS did tell a journalist that "2+2=22", so to speak. What else is there to disprove? The significance of the repo is not to show 2+2=4 but that 2+2 != 22

The BBC quote says "a would-be hacker". I interpreted that as a general claim about windows security, not saying that this particular feature is invisible to malware. They have to break the security of your particular device, the data is nowhere else.

> I interpreted that as a general claim about windows security

Sure, because you understand that the other interpretation is nonsensical. All the publications that are popping up showing that the Recall DB is locally accessible are aimed at all the other Windows users.

Now, I would fully agree if you question what's the benefit of posting this on GH and not on FB, for example, and what's in there to surprise the HN crowd.

Re: TotalRecall: Extracts and displays data from the Windows 11 Recall feature

#56

Post by mvdtnz »

lolinder wrote: post #19

Security aside, I'm genuinely unsure what problem Recall is even meant to solve. Like most AI products and features announced over the past 18 months, it feels like a bunch of product people got into a meeting where they looked at the capabilities of the latest OpenAI model and then started spitballing feature ideas based not on user needs but on what GPTs can do. "Oh, these models can do OCR... why don't we screensh…

I agree completely. The AI rush feels exactly identical to the cryptocurrency rush where people saw a novel technology and started trying to find a problem to solve with it. It feels like it's going nowhere fast, at least to me. The overlap between tasks that are important, time-consuming, amenable to AI and also non-critical enough that I can tolerate serious errors in the output seems very small.

Re: TotalRecall: Extracts and displays data from the Windows 11 Recall feature

#57

Post by pseudalopex »

Dylan16807 wrote: post #52
smarx007 wrote: post #47

Earlier quoted context omitted.

The repo is along the lines of "2+2=4". GP said there is nothing interesting in that, to which I pointed to the QnA entry which shows that MS did tell a journalist that "2+2=22", so to speak. What else is there to disprove? The significance of the repo is not to show 2+2=4 but that 2+2 != 22

The BBC quote says "a would-be hacker". I interpreted that as a general claim about windows security, not saying that this particular feature is invisible to malware. They have to break the security of your particular device, the data is nowhere else.

You interpreted a statement about saved screenshots in an article about Recall as a general claim about Windows security even the general public would know was false?

Re: TotalRecall: Extracts and displays data from the Windows 11 Recall feature

#58

Post by Dylan16807 »

smarx007 wrote: post #55
Dylan16807 wrote: post #52

Earlier quoted context omitted.

The BBC quote says "a would-be hacker". I interpreted that as a general claim about windows security, not saying that this particular feature is invisible to malware. They have to break the security of your particular device, the data is nowhere else.

> I interpreted that as a general claim about windows security Sure, because you understand that the other interpretation is nonsensical. All the publications that are popping up showing that the Recall DB is locally accessible are aimed at all the other Windows users. Now, I would fully agree if you question what's the benefit of posting this on GH and not on FB, for example, and what's in there to surprise the HN c…

> All the publications that are popping up showing that the Recall DB is locally accessible are aimed at all the other Windows users.

See, that's the thing. Proving it's locally accessible...

Microsoft never even implied it wasn't locally accessible.

Re: TotalRecall: Extracts and displays data from the Windows 11 Recall feature

#59

Post by lolinder »

Dylan16807 wrote: post #46
lolinder wrote: post #41

Earlier quoted context omitted.

The point is that the existence of this code proves that remote access is possible, you just use any one of the many proven malware vectors to get the user to install a binary that does the same thing as this repo does but ships it over the network to your servers.

That seems like an unreasonably broad definition of remote access to me. If installing a local program that proxies data counts, then the only true way to make "remote access" impossible is by installing it in a secure room with no networking and where no other electronics are allowed in. How many people interpreted that claim as SCIF-equivalency?

> How many people interpreted that claim as SCIF-equivalency?

Basically everyone who isn't employed in tech? This is what the BBC said [0]:

> And it said a would-be hacker would need to gain physical access to your device, unlock it and sign in before they could access saved screenshots.

Those of us here can readily see that this "physical access" claim is bunk, but that's what Microsoft represented to the BBC and what the BBC is telling the world.

[0] https://www.bbc.com/news/articles/cpwwqp6nx14o

Re: TotalRecall: Extracts and displays data from the Windows 11 Recall feature

#60

Post by pseudalopex »

Dylan16807 wrote: post #58
smarx007 wrote: post #55

Earlier quoted context omitted.

> I interpreted that as a general claim about windows security Sure, because you understand that the other interpretation is nonsensical. All the publications that are popping up showing that the Recall DB is locally accessible are aimed at all the other Windows users. Now, I would fully agree if you question what's the benefit of posting this on GH and not on FB, for example, and what's in there to surprise the HN c…

> All the publications that are popping up showing that the Recall DB is locally accessible are aimed at all the other Windows users. See, that's the thing. Proving it's locally accessible... Microsoft never even implied it wasn't locally accessible.

> Microsoft never even implied it wasn't locally accessible.

BBC said Microsoft said a hacker would need physical access. You can think this meant to hack Recall or Windows.

Post reply on HN