Controversial Windows Recall AI Search Tool Returns (securityweek.com) 68
wiredmikey writes: Three months after pulling previews of the controversial Windows Recall feature due to public backlash, Microsoft says it has completely overhauled the security architecture with proof-of-presence encryption, anti-tampering and DLP checks, and screenshot data managed in secure enclaves outside the main operating system.
In an interview with SecurityWeek, Microsoft vice president David Weston said the company's engineers rewrote the security model of Windows Recall to reduce attack surface on Copilot+ PCs and minimize the risk of malware attackers targeting the screenshot data store.
In an interview with SecurityWeek, Microsoft vice president David Weston said the company's engineers rewrote the security model of Windows Recall to reduce attack surface on Copilot+ PCs and minimize the risk of malware attackers targeting the screenshot data store.
Some bad ideas do not die... (Score:5, Informative)
This is essentially the Panopticon. Sad times when the OS supplier has to be regarded as an enemy of all users.
Sure, they _pretend_ this is secure, but do you really think the usual authoritarian assholes in law enforcement and the TLAs can really restrain themselves? They have to think the Holy Grail of surveillance has been found!
Re: (Score:2)
Be careful of what you say [youtube.com]
Be careful in every way
Be careful of what you do
Big brother is watching you
Be circumspect and discreet
Stay light on your mental feet
One slip and you know you're through
Big brother is watching you
Conform with all directives
Remember obedience pays and when you watch that TV
Screen remember it works both ways You'll disappear in a wink
Unless you can doublethink
You'll vanish into the blue
Big Brother is watching You
Re:Some bad ideas do not die... (Score:4, Funny)
Re:Some bad ideas do not die... (Score:5, Informative)
Most users don't care. And we can't make them care. So, for the most part, Microsoft is right in their beliefs.
They have the means, motive, and opportunity to spy on their users for their own profit. So, they will.
I only use windows for work. And I don't do anything relating to my personal life on my work computer. So, this is my employer's problem, not mine.
Re: (Score:2)
Most users don't care. And we can't make them care.
Nah, we can make them care but too many people start screeching about human rights, that I'm evil incarnate, and other non-sense whenever I start the process. Seriously, people are too sensitive about keeping their eyelids attached and children alive because they are quitters.
Re: Some bad ideas do not die... (Score:1)
Re: (Score:2)
People have had decades to accept that they run software which is intended to serve other parties' interests above their own. And still to this day, we argue over the definition of "malware."
Re: (Score:2)
The thing is, that no matter how much power you give the ' authoritarian assholes in law enforcement and
Re: Some bad ideas do not die... (Score:2)
Who's the more stupid, the elected officials that do this or the voters who keep re-electing them?
Re: (Score:2)
Assholes always need plenty of useful idiots to give them power. And the human race provides.
Re: (Score:2)
So... I imagine this pissed off some politician who had his/her staff DMCA me. Youtube was not willing to listen to me one bit.
Re: (Score:2)
Are they an enemy of the user though, or do you just think so due to lack of information? One of the key things from the announcement not mentioned in this article, but covered in others is that Recall is fully optional and Microsoft will allow the user to completely uninstall it.
https://www.theverge.com/2024/... [theverge.com]
Sure, they _pretend_ this is secure
Literally every attack on the preview has required elevated system privileges. When an attacker has that already you are no longer using your own machine, you're using theirs. Windows recall isn't
Re: Some bad ideas do not die... (Score:2)
Re: (Score:2)
Exactly. With the data-stream going from a Windows PC to Microsoft, who is to tell?
Re: (Score:2)
And, as usual, you do not understand what you are talking about.
1. When somebody gets admin access on your computer and starts surveillance then, that is essentially the first point they get data. With recall, they can get months, maybe years before. This means it becomes very worthwhile targeting users that you know may have something in their recall DB.
2. "Literally every attack on the preview has required elevated system privileges." means exactly nothing. Attacks only ever get better and require less, t
Re: (Score:2)
Having admin access on a target machine is the holy grail of surveillance. It doesn't matter if Recall is installed, or if the system is even a Windows OS.
I disagree, an attacker can now benefit from recall as a persistent threat without having required the attacker to have previously compromised the system.
Re: (Score:2)
Exactly.
Re: (Score:2)
You're worse than naive, you're the target market for this.
Could've modded down, but poking my thumb in your eye just feels more satisfying.
Thanks for the larfs.
Re: So you think this is new? (Score:1)
Surface Area (Score:2)
I'll reduce the surface area by shutting it off and disabling the feature, thank you very much.
Re: (Score:1)
Next update enables it again without your approval
Re: (Score:2)
Considering the amount of disk space it uses it's easy to spot ...
You're screenshotting my desktop (Score:4, Interesting)
and using that to train your AI without my consent. Mr. Weston, YOU are the attacker.
Re: (Score:3)
Exactly. This is a blatant attack on the users, nothing else.
This is even worse (Score:3, Interesting)
Now it provides cryptographically secure proof of whatever your abusive spouse thinks it says. Sorry women, a whole lot of you are going to die horrible deaths because of Microsoft.
Re: (Score:2)
I'm sorry, I don't follow.
Re: (Score:2)
I'm happy you raised this. Having to make a leap of faith to the "think of the abused women" destination means that all other problems with Recall have been addressed right?
Re: (Score:2)
Do you really not understand the problem?
What this means is that an abused spouse can't clandestinely access resources designed to help them. The evidence is always there, just waiting for their abuser to check. Yes, this can get them killed.
There's a reason that it's recommended that mobile apps and websites have a "boss button" or some other way to immediately hide what the user is looking at. For example [thehotline.org].
Why are you so hot to defend this shit anyway?
Re: (Score:2)
On far too many occasions I've had to make a very long road trip to help a friend or family member escape a DV situation. Abusers exploit every single piece of technology to exert control over their victims. I would much rather face a hostile intelligence service than someone that wants to murder their spouse.
Badges? (Score:3)
I don need no steenkin' CoPilot, I don need no steenkin' Recall, I don need your untested buggy security.
Period.
What about PII and proprietary data (Score:2)
That is separate from the insane security risk that now all passwords that are used on the computer will be visible in the screen shots.
I don't know if this is pushed by
Re: (Score:2)
I think it is desperation. MS has sunk tons of money into AI and applications or profits are not materializing. Hence crap like this. Obviously, it is going to be abused and obviously, attackers are going to get in.
My one hope at the moment is that this is likely turning out to be completely illegal in the EU and even the possibility may be illegal already.
Re: (Score:2)
Re: (Score:2)
1984 corporate style (Score:1)
Why was there a rush? (Score:2)
Re: (Score:3)
MS has poured billions into AI and applications or profits are not materializing. They are desperate.
Re: (Score:2)
because AI, blockchain, cloud
Re: (Score:2)
Dumb (Score:2)
Re: (Score:2)
You don't get a second chance to make a first impression.
You would think MS learned that after the Xbox One launch, but no.
That's nice, but... (Score:3)
That's nice, but have they bothered to overhaul their answer the following question: why the hell would anybody want or need this?
Re: (Score:2)
That's easy. Their customers asked for it.
Their customers. You know, advertisers. They're all asking "How do I choose which users' eyes are worth paying for?"
Opt-in by default and can be removed (Score:2)
From TFA:
Recall will now be an “opt-in experience” during setup. “If a user doesn’t proactively choose to turn it on, it will be off, and snapshots will not be taken or saved,” he explained, noting that Windows users can remove the feature entirely.
“You can remove it completely, never be turned on in future,” Weston said.
Also:
Under the hood, the Microsoft VP said snapshots and any associated information in the vector database are always encrypted with keys that are protected by the TPM (Trusted Platform Module), tied to a user’s Windows Hello Enhanced-Sign-in Security identity.
“You have to have proof-of-presence to turn it on,” Weston said.
No one fucking wants it (Score:5, Insightful)
Normally I'd like to avoid cursing and put well thought out words into the world but are you fucking kidding me? No one fucking wants it, no one, no one fucking wants it.
Ohhhh we made it more secure to add...you missed the part where no one fucking asked for it, and no one fucking wants it. The only person who wants it, is fucking microsoft to collect more data.
I don't care how secure and proof of security for a feature NO ONE FUCKING WANTS is. It shows your clear deception to gather data WE DO NOT WANT TO FUCKING GIVE YOU.
Maybe it'll be mega quantum forever secure! Great NO ONE FUCKING WANTS IT STILL. The miscommunication, is we don't fucking want it.
Address that concern by fucking off.
Re: (Score:2)
Time will tell. Microsoft is giving the users the ability to uninstall it, completely. https://www.theverge.com/2024/... [theverge.com] let's see after release if you're right, or if (as I suspect) only a few vocal minority of people don't want it / give a shit enough to care about it.
By the way I remember the iPhone announcement here like it was yesterday. I'm sure someone said NO ONE FUCKING WANTS IT in all caps when they were shown a phone without a keypad as well. More power to you as an individual but I suspect you a
Re: (Score:2)
Yes, odds are good that users won't know about it or understand it. That doesn't make it okay. That makes it far more nefarious.
There's a reason that this is "opt-out" and not "opt-in". They're trying to force it on as many people as possible, most of whom don't understand what it does or what danger it presents. Do you honestly think this is a good thing? Do you not understand the problem?
Also, Microsoft has developed a habit of changing user preferences after normal updates. They also make it difficu
Re: No one fucking wants it (Score:2)
That's why in our organization Windows Update is considered harmful. We block it actively using both the perimeter firewall, group policies and third-party utilities. Windows machines don't face the Internet directly, plus their built-in update-needing Internet client crap like Edge, Onedrive, Defender etc. is disabled, so we're not really in danger. Once a year or so, we allow Update to run, review the crap it has brought, and disable it again. YMMV, but for us this works very well
Re: (Score:2)
A recall feature collects your screenshots and words you type in a textbox and the sequence of icons and menu items you click on for context, so the AI can complete your actions instantly.
No recall == No AI == No Microsoft.
BTW, this is not just a Microsoft thing, all the other AI personal assistant peddling companies are looking for ways to use or implement a recall sy
Re: (Score:2)
No one fucking wants it
Correct, but you and every one here knows exactly how to avoid Copilot and Recall. But do not make the jump to a Free OS for 100% usage. So you get what you get and you have no one to blame :)
If enough tech people refuse to use Windows at home and at work, an then they tell their friends and family to avoid windows at all costs, Microsoft may just change. But more then likely people will realize they were being abused by M/S for decades and be quite happy with their new environment.
Re: (Score:2)
Correct, but you and every one here knows exactly how to avoid Copilot and Recall. But do not make the jump to a Free OS for 100% usage.
Yes and no. For work I'm stuck with Windows, for my personal PC, oh do I love me my linux, okay, sure I stick to ubuntu for my daily driver as I don't want to get all bashfu on a daily basis, but I agree with you though, that's exactly the problem.
Not minimized (Score:3)
The risks of screenshot data being targeted is ZERO if there is no screenshot data. Anything above that is not an example of minimized risk.
They mean they THINK they made the risk smaller but if the customer doesn't even want the feature, the risk/reward ratio is still infinity.
This is happening whether we like it or not (Score:2)
Gore was in favor of continuing the antitrust fight and Bush had made it very clear he had no intentions of doing so. George Bush won and so Microsoft was never broken up and so we have no significant competition in the PC marke
What's this? (Score:2)
What's this process called ThirdEye.exe that shows up in Task Manager?
Syntactic ambiguity (Score:2)
No one wants this (Score:2)
What hardware does this depend on? (Score:2)
Let's imagine that (Score:2)
A store tries to sell you a phone that "records all your conversations for your own good, lest you forget something", and sends them to the cloud under escrow. The cloud is super-duper secure, and only you can access the recorded data (or the authorities, of course, but only with a court order). Will you buy this? Think carefully.
I personally, would tell the seller to shove it up his azz. How about you?
MS is so far behind Google, they will try anything (Score:1)