Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft will switch off Recall by default after security backlash

wired.com

Post reply on HN
Print view View original

71–80 of 572 posts

Re: Microsoft will switch off Recall by default after security backlash

#71

Post by ndiddy »

paxys wrote: post #28
nerdjon wrote: post #6

Will have to wait and see if the extra security measures actually improve anything or not. However regarding it being opt out… what would prevent a virus from just enabling it on a bunch of machines silently. Sure it would be caught but the damage done and most won’t be bothered to go in and disable it after. Or Microsoft just decides they need to really market the hell out of AI and it gets turned on my default anyw…

What would prevent a virus from directly stealing the data it wants without going through this feature?

Without Recall, an attacker needs to get a program to stay resident in memory to log keystrokes, screen contents, etc. for an extended period of time without getting detected. With Recall, they can get the same end effect by exfiltrating the Recall database file whenever it's convenient (i.e. an infected version of a text editor could send it while pretending to check for updates). This significantly lowers the barrier to entry for getting a victim's data, while also making it much easier to avoid detection.

Re: Microsoft will switch off Recall by default after security backlash

#73

Post by modeless »

It is puzzling to me that so many people seem to think this concept has no value. To me the concept is obviously good and something I have wanted for a long time.

Of course the security of the implementation is important and I agree with some of the criticism there. But I see a lot of people arguing that the feature is worthless, or that it doesn't make sense at the OS level, or that Microsoft specifically should not be allowed to add it to Windows, and I have to strongly disagree.

Re: Microsoft will switch off Recall by default after security backlash

#74

Post by bonton89 »

AlexandrB wrote: post #65

All I can say is LOL. Off by default for Windows 11 24H2, on by default in Windows 11 25H2, impossible to disable in Windows 11 26H2 (except in enterprise versions of course). Microsoft's history with respecting the user's wishes speaks for itself.

Not to mention all the dark pattern lying nag dialogs that will trick you into turning it on, or just wear you down.

Re: Microsoft will switch off Recall by default after security backlash

#75

Post by 3qmtacr674qac »

organsnyder wrote: post #16

I still don't understand how this got this far. Enabling this in any corporate setting would be a compliance nightmare.

With Chat Control[1] coming up in EU, it would be awfully convenient to have the technological capability readily available to deliver a solution.

Once you have the Recall capabilities, it doesn't take much to start collecting and searching the data.

[1]: https://www.patrick-breyer.de/en/posts/chat-control/

Re: Microsoft will switch off Recall by default after security backlash

#76

Post by ydnaclementine »

herf wrote: post #58

It's interesting to compare this to the Chrome/Safari/Edge browsing history, which is stored in an unencrypted SQLite database, and tracks what you do for the last 90 days. It's just a bit less visual, Incognito/Private modes work, and some users clear it more often. But a whole lot of the surveillance attacks people imagine about Recall apply just the same to the browser. I think it's the "little brother" casual att…

Does Recall run entirely locally? I don't think your browser history gets sent out

Re: Microsoft will switch off Recall by default after security backlash

#77

Post by herf »

EGreg wrote: post #67
herf wrote: post #58

It's interesting to compare this to the Chrome/Safari/Edge browsing history, which is stored in an unencrypted SQLite database, and tracks what you do for the last 90 days. It's just a bit less visual, Incognito/Private modes work, and some users clear it more often. But a whole lot of the surveillance attacks people imagine about Recall apply just the same to the browser. I think it's the "little brother" casual att…

Browsing history doesn't contain what's displayed on the page, and what you input into the input boxes, or POST requests. It's sorta like telephone metadata. On the other hand, I am always freaked out by Chrome extensions that "can read and change your data on all websites ". Can't they have more granular permissions? You gotta have a lot of trust for those extensions LMAO. They can read your bank passwords, probably…

Exactly - knowing the content of each webpage is pretty easy if you're "big brother" surveilling millions of people, even more so if you have a Chrome extension to help.

It's "little brother" that benefits a lot here: bosses, spouses, parents, etc., who otherwise wouldn't click on 1000 links in your history.

Re: Microsoft will switch off Recall by default after security backlash

#78

Post by ASalazarMX »

AlexandrB wrote: post #65

All I can say is LOL. Off by default for Windows 11 24H2, on by default in Windows 11 25H2, impossible to disable in Windows 11 26H2 (except in enterprise versions of course). Microsoft's history with respecting the user's wishes speaks for itself.

Given their eagerness, I'd guess:

> on by default in Windows 11 25H1, impossible to disable in Windows 11 25H2

Re: Microsoft will switch off Recall by default after security backlash

#79

Post by mschuster91 »

modeless wrote: post #73

It is puzzling to me that so many people seem to think this concept has no value. To me the concept is obviously good and something I have wanted for a long time. Of course the security of the implementation is important and I agree with some of the criticism there. But I see a lot of people arguing that the feature is worthless, or that it doesn't make sense at the OS level, or that Microsoft specifically should not…

The concept itself has value, but the ethical and legal concerns are severe, not to mention the issue of Recall also capturing sensitive stuff like passwords.

Microsoft, Google, Apple - everyone is scared shitless of some AI startup kicking their nutsacks, and is launching products that should have gone through extensive ethics discussions beforehand in a matter of weeks.

Re: Microsoft will switch off Recall by default after security backlash

#80

Post by ls612 »

EGreg wrote: post #67
herf wrote: post #58

It's interesting to compare this to the Chrome/Safari/Edge browsing history, which is stored in an unencrypted SQLite database, and tracks what you do for the last 90 days. It's just a bit less visual, Incognito/Private modes work, and some users clear it more often. But a whole lot of the surveillance attacks people imagine about Recall apply just the same to the browser. I think it's the "little brother" casual att…

Browsing history doesn't contain what's displayed on the page, and what you input into the input boxes, or POST requests. It's sorta like telephone metadata. On the other hand, I am always freaked out by Chrome extensions that "can read and change your data on all websites ". Can't they have more granular permissions? You gotta have a lot of trust for those extensions LMAO. They can read your bank passwords, probably…

To be fair for me the extensions that get that are uBO, Privacy Badger, and Tampermonkey.

I trust gorhill and the EFF to not fuck me over on my data, and Tampermonkey kinda needs those sorts of permissions to work. My password manager has read access to every website but I'm already trusting it with all of my passwords so...

Post reply on HN