Controversial Windows Recall AI Search Tool Returns with Proof-of-Presence
securityweek.com
securityweek.com
Look, it's all good and dandy, but when I hear "option" from Microsoft, I just _recall_ how often they are reset on every update. Do we have to list the number of "oups, that was a bug, sorry" incidents that have happened with Edge?
Microsoft did a pretty good job to ruin the little confidence we had in their name. They kind of dig their own grave.
The only way to make people believe Recall is not a privacy nightmare is to fully release the full source of Windows for examination by the Free Software Community. Anything short of that will be branded as "marketing speak" or even lies.
>Weston argues that this design protects against malware and unauthorized access through rate-limiting
What about "authorized access", who defines that. If Microsoft, there in lies the problem.
> What about "authorized access", who defines that.
I don't think the intent is that they distinguish between unauthorized and authorized access and then only rate-limit the former, but rather that they're implementing a rate-limit on all access low enough to hinder malware extracting all snapshots while high enough to hopefully not impact normal usage.
But I agree that releasing the source code would be useful to let people properly verify these properties.
This wasn't so hard, was it? Why wasn't it done before? To me, the fact that the new recall architecture wasn't in the initial release says that there are still huge security culture issues. But organizational culture is slow to change, and Recall has happened in parallel with the new security reforms, so you can't expect them to get rid of their old ways over night.
As others in the thread have pointed out, it seems Microsoft are promising things that are very non-Microsoft-y, like promising to never re-activate, promising an easy opt-out to never be bothered again, and promising that activating the service in the first place is an opt-in-during-install feature. Microsoft have a reputation for being a pushy company that doesn't take no for an answer, and coupled with the recent security culture issues, I have personally started recommending non-tech people to just switch to Apple now before things get worse. Can we trust that Microsoft won't backpedal on their promises? Fool me once, shame on you, fool me twice...
Exactly, this Recall feature exists in the context of all the user-hostile crap Microsoft has been pushing for the past decade or so. Those design decisions are a direct reflection of Microsoft's values and culture. Even if Recall itself is indeed perfectly fine, I wouldn't use it because the service operator is demonstrably disrespectful of their users' agency.
I bet it would also ensnare more well-wishing sysadmins and non-tech consumers who take singular instances of apologizing/fixing at face value.
Surely that isn't good for MS in the long term? Having a userbase that likes using your product must be better for business than a userbase that has been taught to be wary of anything you do, and to dismiss anything you come out with based on previous "features".
Is it the typical hacker news theory of management looking for short term user number growth to get promoted, or something else entirely?
When apple releases features, most of their userbase is excited. They have learned that in most cases it's either something cool they can use straight away or an optional service that they might or might not need. Apple still does some annoyances to push their services, but not nearly as bad as MS.
Microsoft is free to create new software for their OS, but they shouldn't make them a dependency of said OS.
Got to get the ‘feature’ out before the bubble bursts, regardless of how broken it is.
Still not going to use that or windows for anything serious, but credit where credit is due.
I spend so so much time looking for information I saw in the past...a document, a conversation, a website, etc. This will be a big time saver and have a ton of utility.
To those that are scared of it: don't use it. I can make my own choices.
You can not trust Microsoft and that's totally valid, I don't, but I also don't use Windows. It's a really stupid line to draw if this is the straw. They control the entire OS, basically force online accounts, have been confusing the line between remote and local storage for years, exfiltrate local searches to Bing, track everything for in-app and in-os advertising and send undisableable telemetry. Does this feature just lay bare the reality you've been living under for years?
That would be a straightforward example of "can't read the browser history for a user, but could read it indirectly via the agent."
Let me fix that... People don't trust Microsoft.
(I don't particularly trust Microsoft, but I'm also not in their ecosystem.)
That should be the headline, if true.
An indication of the state of online publishing. Even when a story has a compelling point, it can be lost in getting it out quickly for clicks.
I've heard differently. You can turn Recall off but not remove it. And if it's anything like other privacy settings, Windows Updates tend to, er, adjust those settings... to the ones Microsoft prefers you'd be using.
From where?
https://www.windowscentral.com/software-apps/windows-11/turn...
Yet it acts like an amazing built in tool for scammers that has fooled millions of people.
MS will never apparently learn that visibility and logging mean nothing to anyone unless they actually understand what the heck is going on. The same with that the countless "press yes now, no, don't read this box because it's meaningless, what you need to do is press yes to get on with life" boxes.
Giving people more complexity. More tools no one will understand or use. Like the ability to filter out specific websites. It's just the same ridiculous MS approach to everything. Except that now when people's machines are compromised it will be even worse for them.
The whole point of AI is to make things simpler for users. Not to add yet another massive layer of complexity.
The next jump in computer interfaces is going to be Star Trek style stuff and for that you need access to see what the user sees.
That feature, with its shit security, was designed, aplroved, implemented, reviewed, and see by COUNTLESS PMs, engineers, and managers.
No one cared. That culture is rotten to its fucking core. Microsoft never gave a shit about good engineering when I was there, highly preferring to gaslight and go over peoples heads, dare they say that the entire (initial) design of VMSS is flawed, or that maybe just maybe Azure would benefit from a metadata service and machine identities. Literally "controversial" shit that resulted in my manager getting emailed.
Every, single engineer, bar one, that I respected at that company has left. Says something.
I know it's a hot take but people are out of their minds trusting a Microsoft platform if they care at all about personal or business privacy.
Are the millions of businesses that really on Ms products going to change systems? No.
Not sure what I'm getting at with this. Maybe just trying to logic my way through this decision?
MS has the largest and most well guarded moat in existence. They're simply wringing out the profits now.
Microsoft's entire org structure and mode of operation leads to these same results over and over across windows and azure.