Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft Research chief scientist has no issue with Recall

theregister.com

Post reply on HN
Print view View original

51–60 of 91 posts

Re: Microsoft Research chief scientist has no issue with Recall

#51

Post by ankurdhama »

klauserc wrote: post #44
ankurdhama wrote: post #30

The whole drama around with how Recall store data is misguided. The problem is not how this data is stored, it is more fundamental i.e how windows doesn't have a proper app sand boxing. MS App store apps have sandboxing and permission model but most of other apps on windows are still just bunch of DLLs and EXEs that run with all the permissions that the current user have. Until MS solves this problem there is no way…

There is Windows S Mode where you can only run Windows Store apps and only use Microsoft Edge. That should qualify for "proper sandboxing", shouldn't it? Then again, no one who needs an actually useful computer runs Windows in S mode.

> Then again, no one who needs an actually useful computer runs Windows in S mode.

That's because of all useful apps for Windows are not sandboxed. This is where the apps vendor have to do the required work but they are too lazy to do that.

Re: Microsoft Research chief scientist has no issue with Recall

#52

Post by bsmartt »

bsmartt wrote: post #35
leokennis wrote: post #19

Earlier quoted context omitted.

Some excerpts from https://doublepulsar.com/recall-stealing-everything-youve-ev... : ---------- Q. So how does it work? A. Every few seconds, screenshots are taken. These are automatically OCR’d by Azure AI, running on your device, and written into an SQLite database in the user’s folder. This database file has a record of everything you’ve ever viewed on your PC in plain text. OCR is a process of looking an image, a…

so official microsoft documentation vs infosec twitter. that's not how you back up an argument with proof. there are no microsoft engineers in that video. i see a laptop. is that from tiktok? how are you taking this guy's word for shit without even thinking? its like 13 seconds taken out of context showing a folder click and authorization (what's even happening here, is this an admin account?)

We can talk about vulnerabilities that’s the first decent point I’ve seen in this entire comment section.

So youre saying that since there will be vulnerabilities (discovered and hopefully patched quickly) this Is a privacy violation?

If anything what you point out is good, we should all audit the feature on launch. Probably gonna be some good bug bounties here.

Re: Microsoft Research chief scientist has no issue with Recall

#53

Post by KronisLV »

wolpoli wrote: post #16
KronisLV wrote: post #14

Earlier quoted context omitted.

It would be good for security but horrible for usability. I recently got an iPhone and had to migrate to it from my Android phone which turned out to be really unpleasant because I could not carry over WhatsApp data. Turns out that the SQLite database is encrypted and I can’t easily carry it over, nor even get the encryption key in a non-rooted device. Furthermore, there is also the issue that Android only backs up t…

I also looked into transferring WhatsApp data from Android to IOS recently and there is an official way to transfer in both directions now. https://faq.whatsapp.com/686469079565350/?helpref=hc_fnav I didn't end up going through with it through since there was no way to take a Signal backup created in Android and restore it to IOS.

> Your iPhone must be factory new or reset to factory settings to pair with the Move to iOS app and move data from your Android phone

As I pointed out in the post, this was pretty much the dealbreaker for me. I had initially set up the iPhone without all of my accounts, just for development, but had gradually carried over my accounts and the apps I need to use. And then I find out that I’d basically need to wipe all of the progress and start over, just because the data move can’t be initiated with an already set up phone (which probably made developing the app easier, but at the same time limits its usefulness).

Re: Microsoft Research chief scientist has no issue with Recall

#54

Post by belter »

bsmartt wrote: post #46
EdwardDiego wrote: post #29

Working at a company in the healthcare space, this raises so many HIPPA compliance questions for our customers it's hilarious. And by hilarious, I mean bad. Screenshots of PHI? Sweet as, just chuck them in an SQLite DB, no worries there.

well good news, this feature can be 100% disabled by your IT team, and you dont need these snapdragon high end consumer laptops in your hospital anyway. why am i having to defend microsoft? have we all lost our minds? or do we just shoot first, ask questions later for the lulz

Please point to a documentation reference that shows an officially supported way, to completely disable all telemetry on Windows OS...

Re: Microsoft Research chief scientist has no issue with Recall

#55

Post by hostyle »

bsmartt wrote: post #46
EdwardDiego wrote: post #29

Working at a company in the healthcare space, this raises so many HIPPA compliance questions for our customers it's hilarious. And by hilarious, I mean bad. Screenshots of PHI? Sweet as, just chuck them in an SQLite DB, no worries there.

well good news, this feature can be 100% disabled by your IT team, and you dont need these snapdragon high end consumer laptops in your hospital anyway. why am i having to defend microsoft? have we all lost our minds? or do we just shoot first, ask questions later for the lulz

"Move fast and break things."

"Its easier to ask for forgiveness than ask for permission."

There are many other well known mantras that i can't recall right now. SV and VC companies do not care in the slightest about users and their data - only about making more money (which these days always seems to involve stealing^Wwarehousing more and more data).

Re: Microsoft Research chief scientist has no issue with Recall

#56

Post by SushiHippie »

KronisLV wrote: post #14
wolpoli wrote: post #11

I have a different take on this. If the same feature were built on Android or iPhone, the data would be encrypted, and the researchers would have had a hard time accessing the SQLite file itself. Microsoft's takeaway from this negative news would be that it needs to lock down Windows 12 by adopting designs from Android and iPhone, effectively closing it off.

It would be good for security but horrible for usability. I recently got an iPhone and had to migrate to it from my Android phone which turned out to be really unpleasant because I could not carry over WhatsApp data. Turns out that the SQLite database is encrypted and I can’t easily carry it over, nor even get the encryption key in a non-rooted device. Furthermore, there is also the issue that Android only backs up t…

FWIW I did manage to decrypt the sqlite database with the encryption key that you create for google drive backups (and should have noted down somewhere).

It's been a while, but I think I used this github repo [0], that was the first search result, and it also mentions the 64 character long key.

[0] https://github.com/ElDavoo/wa-crypt-tools

Re: Microsoft Research chief scientist has no issue with Recall

#57

Post by bsmartt »

leokennis wrote: post #49
bsmartt wrote: post #35

Earlier quoted context omitted.

so official microsoft documentation vs infosec twitter. that's not how you back up an argument with proof. there are no microsoft engineers in that video. i see a laptop. is that from tiktok? how are you taking this guy's word for shit without even thinking? its like 13 seconds taken out of context showing a folder click and authorization (what's even happening here, is this an admin account?)

You are aware by whom vulnerabilities are usually discovered? Hint: it’s usually not by the companies that shipped them.

Following this logic you really shouldn’t use Microsoft products. Or Apple. Or google. Or Mozilla. Either way, you are better off with a bug in this dumb as hell feature than you are with a bug in your web browser. Yet here we are, spurging out over recall.

Re: Microsoft Research chief scientist has no issue with Recall

#58

Post by bsmartt »

sanitycheck wrote: post #42
bsmartt wrote: post #31

i dont understand why everyone is so confused and outraged. first off, it doesnt affect you. even if you do buy a microsoft laptop that is being marketed as the "ai powered technology revolotion" (or whatever), its shipping from the start with almost all the tools i can think of to help you only recall what you want. application exclusion by ifn, pause the stored data / purge stored data / or opt out forever. if you…

This is Microsoft building an automated AI corporate panopticon. Its presence on every PC will enable and normalise hitherto unseen levels of surveillance and control over employees. It ain't a good thing.

Would you rather your it department have a root cert trust authority installed in your trust chain or recall running? The levels are already astronomical if wanted.

Re: Microsoft Research chief scientist has no issue with Recall

#59

Post by surfingdino »

Microsoft Research should really drop "research" from its name. We are not talking Bell Labs-level of research here. They come up with the most useless "inventions" like Multimouse https://www.microsoft.com/en-us/research/blog/multimouse-mak... so why are we surprised that Recall is criticised so much?

Re: Microsoft Research chief scientist has no issue with Recall

#60

Post by slowmovintarget »

hostyle wrote: post #55
bsmartt wrote: post #46

Earlier quoted context omitted.

well good news, this feature can be 100% disabled by your IT team, and you dont need these snapdragon high end consumer laptops in your hospital anyway. why am i having to defend microsoft? have we all lost our minds? or do we just shoot first, ask questions later for the lulz

"Move fast and break things." "Its easier to ask for forgiveness than ask for permission." There are many other well known mantras that i can't recall right now. SV and VC companies do not care in the slightest about users and their data - only about making more money (which these days always seems to involve stealing^Wwarehousing more and more data).

I get your point, but Microsoft is neither Silicon Valley, nor a Venture Capital firm. They are "Big Tech" though.
Post reply on HN