Microsoft Research chief scientist has no issue with Recall
theregister.com
theregister.com
And by hilarious, I mean bad. Screenshots of PHI? Sweet as, just chuck them in an SQLite DB, no worries there.
why am i having to defend microsoft? have we all lost our minds? or do we just shoot first, ask questions later for the lulz
This falls well into the category of a feature that nobody asked for and which shouldn’t exist. Microsoft will make this opt out (if we’re lucky enough) and if even then it will be difficult and hidden to do so, so they’ll trap all the normal users and harvest insane amounts of data.
I have no problems shooting first when the receiving end is Microsoft, because it’s pretty much always deserved.
I am curious what makes you say that. I don't use Windows any more, but I have been experimenting with setups that basically try to do the exact same thing a fair bit lately. I've tried multiple different projects from different authors/teams that solve the same basic problem, it definitely doesn't seem like something nobody is asking for/wants.
"Its easier to ask for forgiveness than ask for permission."
There are many other well known mantras that i can't recall right now. SV and VC companies do not care in the slightest about users and their data - only about making more money (which these days always seems to involve stealing^Wwarehousing more and more data).
* I want to know everything about you and who you talk to (privacy violations)
* I can change deals unilaterally and do whatever I want without your say-so (disrespecting user agency)
* You can't leave me (vendor lock-in)
is about as close as we get.
Also: "Services Configuration is used by Windows components and apps, such as the telemetry service, to dynamically update their configuration. If you turn off this service, apps using this service may stop working."
But they are referring to telemetry as in updating apps metadata so using weasel words.
It just ways to manage and minimize telemetry data Windows 10 and Windows 11 send to Microsoft, focusing on settings, Group Policies, and registry configurations. It explicitly states that certain data connections,cannot be disabled. This implies that completely removing telemetry is impossible.
They are also known to re-enable these settings with each Windows Update....
Also by the way...although unrelated to the question, does not by itself guarantee compliance, as addressed in the FAQ:
"Does having a Business Associate Agreement with Microsoft ensure my organization's compliance with HIPAA and the HITECH Act?"
"No. By offering a Business Associate Agreement, Microsoft helps support your HIPAA compliance. However, using Microsoft services does not on its own achieve HIPAA compliance..."
Not to mention that HIPAA compliance specifically protects health information (ePHI). It does not cover other types of data, so companies like Microsoft can collect and use telemetry data without violating HIPAA, even if this raises privacy issues.
> do we just shoot first, ask questions later for the lulz
Oh mate, this is so ironic that I'm also convinced you're doing it on purpose.
If so, how is that excusable for a company like Microsoft? I'd say even a weekend hackathon project would implement more security than that?
> Snapshots are encrypted by Device Encryption or BitLocker, which are enabled by default on Windows 11. Recall doesn't share snapshots with other users that are signed into Windows on the same device. Microsoft can't access or view the snapshots.
You can delete your snapshots at any time by going to Settings > Privacy & security > Recall & snapshots on your PC.
source: https://support.microsoft.com/en-us/windows/privacy-and-cont...
----------
Q. So how does it work?
A. Every few seconds, screenshots are taken. These are automatically OCR’d by Azure AI, running on your device, and written into an SQLite database in the user’s folder.
This database file has a record of everything you’ve ever viewed on your PC in plain text. OCR is a process of looking an image, and extracting the letters.
Q. How do you obtain the database files?
A. They’re just files in AppData, in the new CoreAIPlatform folder.
Q. But it’s highly encrypted and nobody can access them, right?!
A. Here’s a few second video of two Microsoft engineers accessing the folder:
https://cyberplace.social/@GossiTheDog/112535509953161486
----------
that's not how you back up an argument with proof. there are no microsoft engineers in that video. i see a laptop. is that from tiktok? how are you taking this guy's word for shit without even thinking? its like 13 seconds taken out of context showing a folder click and authorization (what's even happening here, is this an admin account?)
So youre saying that since there will be vulnerabilities (discovered and hopefully patched quickly) this Is a privacy violation?
If anything what you point out is good, we should all audit the feature on launch. Probably gonna be some good bug bounties here.
For starters:
* Because it's been confirmed and demonstrated by other people too?
* Because Total Recall (https://github.com/xaitax/TotalRecall) is a thing that you can try yourself?
* Because Microsoft's entire response to concerns has basically been "oh it's fine, _trust us_"
Hint: it’s usually not by the companies that shipped them.
And yet..
> Q. So how does it work?
> A. Every few seconds, screenshots are taken. These are automatically OCR’d by Azure AI, running on your device, and written into an SQLite database in the user’s folder.
Heads up, Microsoft runs azure. They likely get it before the local users database does.
by saying this, you are also claiming microsoft has windows 11 backdoored.
and thanks for the heads up, thats news to me.
As a user I'm not realistically going to audit every new line of code in a piece of software with every update (if I even can) and I do not at all like the current model where we have to trust software creators blindly. It's the reason anti-virus/malware software is necessary on Windows.
As a developer I would much rather that users don't have to trust us blindly, "this app only needs an internet connection and access to this one directory" would be a far easier sell than the current scenario.
Popups, in the Windows UAC sense, yes, those are utter shit and train users to automatically give permission. Giving specific permissions once, more like Android, is much better.
Then again, no one who needs an actually useful computer runs Windows in S mode.
That's because of all useful apps for Windows are not sandboxed. This is where the apps vendor have to do the required work but they are too lazy to do that.
If the same feature were built on Android or iPhone, the data would be encrypted, and the researchers would have had a hard time accessing the SQLite file itself.
Microsoft's takeaway from this negative news would be that it needs to lock down Windows 12 by adopting designs from Android and iPhone, effectively closing it off.
I recently got an iPhone and had to migrate to it from my Android phone which turned out to be really unpleasant because I could not carry over WhatsApp data.
Turns out that the SQLite database is encrypted and I can’t easily carry it over, nor even get the encryption key in a non-rooted device.
Furthermore, there is also the issue that Android only backs up to Google Drive whereas the iPhone only backs up to iCloud so I could not restore from backup either.
A task that should have taken minutes took me hours and I had to buy some questionable software.
https://blog.kronis.dev/everything%20is%20broken/iphone-andr...
https://faq.whatsapp.com/686469079565350/?helpref=hc_fnav
I didn't end up going through with it through since there was no way to take a Signal backup created in Android and restore it to IOS.
As I pointed out in the post, this was pretty much the dealbreaker for me. I had initially set up the iPhone without all of my accounts, just for development, but had gradually carried over my accounts and the apps I need to use. And then I find out that I’d basically need to wipe all of the progress and start over, just because the data move can’t be initiated with an already set up phone (which probably made developing the app easier, but at the same time limits its usefulness).
It's been a while, but I think I used this github repo [0], that was the first search result, and it also mentions the 64 character long key.
If you still have the key and encrypted database, you "only" need to:
1. Have python
2. Install the project like described in the README
3. Execute
wacreatekey --hex <your_64_characters>
wadecrypt encrypted_backup.key msgstore.db.crypt15 msgstore.dbI can think of no value in a mass of ocr'd screen shots that is remotely worth the cpu and disk cost of generating them or the security risk of them merely existing anywhere, even if the code to do it was gpl.
And the real problem is not me anyway. I use linux. But not one of my relatives I care about does. They are all going to have these terrible things. I can directly take care of a few of them but not most.
Not to mention just everyone else everywhere.
It should be either:
- browser only and semantically understand and hide sensitive information like password fields (or even all input fields)
- or capture stuff from the display server and make it configurable which applications should be ignored (e.g. password manager), and even prompt with each newly opened window if the user wants to remember that session
...and that's just the basics, if we go into details I'm sure there's much more to it.
He cant recall what he really thinks of recall due to the serious business of getting his "sandwiches wrapped in a road map" and sent on his way.
Part of the problem is that MS has never realigned their internal incentives with their stated goals. The best way to get a good bonus or a promotion is to deliver "impactful" features. Once recall is out there, teams will be chomping at the bit to (ab)use its data to quickly and easily demonstrate impact.
Compounding the problem is that MS has no overarching product vision. No one there is really championing the sort of clean, functional, no-nonsense OS that we all know Windows could be. Or if they are, they are being drowned out by people who have dollar signs in their eyes. Compounding that problem is that ICs and teams are strongly encouraged to be "data-driven", which means a sense of product vision is outright ignored unless you can repeatedly and consistently make up metrics that work towards a clean, functional, no-nonsense OS. This is difficult when your metrics are things like, "did the A group click this button more than the B group".
But honestly, it’s like it was designed for the way I work. I dont have a trillion tabs open any more.
I run multiple projects at once plus personal stuff throughout the day. Really really poor project management. But now I just go about what I’m doing and can pickup where I left off.
Literal use case: I was writing a report for a client and had done a bunch of research on a topic, then got distracted as I remembered I needed to upgrade the homelab and wanted new unifi gear. Then got back on another project where I needed provide a summary of similar other projects we had worked on.
So after I finished the last task, I quickly pulled up the research where and where I was at, it even found items I didn’t notice initially. Then at a day later I was able to pull up all the spec sites, reddit posts and recommendations and shopping sites I found for the cheapest place to buy my new gear.
It was awesome.
And that’s one of many many times it saved me.
Whenever you hear or read this phrase during any sort of backlash you can expect bullshit answer
If only there was some way for me to find it...
anyone who is worried about screenshots leaking, do you guys remember photoshop?
we already have keyloggers, banking trojans, infostealers, and for someone to access your recall screenshots they'll be in a position to infect your laptop with all the usual suspects in commodity malware. so they could start logging your keystrokes, pilfer your chrome browsing data, or they could start downloading a 25 GB file that they can't even decrypt, and (lets just allow them to decrpyt somehow). now they get the pleasure of looking through 25 gb of cat pics and reddit hoping they might find a picture of you logging into your bank where you toggle the show password field button. or maybe you don't ever reveal the password so he gets really mad because his ISP only gives him 30GB down / month and he just burned nearly all of it. he decides to dox you and your data, but there isnt anything connecting your real identity to these screenshots (which again, couldve been photoshopped, or you could create your win11 username as Sam Altman). And none of this is even going to happen this would be the first time ive ever heard of a hands on keyboard commodity malware controller who is targeting whomever he can breach and rather than just sitting back while keyloggers and bots phone home and exfil sensitive data as text in an automated way, he's at home dealing with these massive encrpyted archive files and bajillions of screenshots.
everyone be triflin' over some bullshit here, you guys know why they did this right, not because its useful or a good use of AI. all the big guys are racing to cash in on the consumer AI market and they want to tell wall st on the quarterly earnings reports that theyve got a new go to market strategy with AI and its going to lead to N revenue, and instead of slightly faster hardware the next surface launch is gonna be huge marketing event and if you guys in nyc want to bet on ai for consumers, buy more microsoft stock.
isnt this obvious my friends?
Its presence on every PC will enable and normalise hitherto unseen levels of surveillance and control over employees.
It ain't a good thing.
It’d be so much easier to have recall store the data and then have the processor power do the AI analytics on the data.
You also fail to remember the past. Microsoft has a history of changing security settings with updates. Just because the data is stored locally just now does NOT mean that in a few updates time that they won’t change it.
If you genuinely cannot see that it is the slow introduction of powerful NSA surveillance tech, it just means you don’t know Microsoft enough. NSAKey and Prism - Windows has always been about NSA.
This particular surveillance software is leaps better than anything which has become before it, because now they can make the users computers do all the processing and storage. It is vastly superior than their other techniques in so many ways than the methods you mentioned.
Another thing you seem to mix up is that why would NSA have to do all the hard work to surveil system like you mentioned? They can simply hop on to the connections Windows makes to it’s own Microsoft servers. In the same way that AT&T historically had a NSA room in their premises which the entire network went through.