- cross-posted to:
- [email protected]
- [email protected]
- [email protected]
- [email protected]
- cross-posted to:
- [email protected]
- [email protected]
- [email protected]
- [email protected]
Q. Is this really as harmful as you think?
A. Go to your parents house, your grandparents house etc and look at their Windows PC, look at the installed software in the past year, and try to use the device. Run some antivirus scans. There’s no way this implementation doesn’t end in tears — there’s a reason there’s a trillion dollar security industry, and that most problems revolve around malware and endpoints.
You must log in or register to comment.
The full article is well worth reading. It’s good to find a lucid, logical deconstruction of why, precisely, this will be a complete disaster.
THIS IS NOT CURRENTLY RUNNING ON MY WINDOWS COMPUTER, right?
This obvious first question hasn’t been clarified (maybe by one comment in this thread, but not in the article)
You’ll have the icon on your taskbar if it is. You can also hit Meta+J to check
deleted by creator
I think that’s just regular Copilot (without the plus). This is a newer version, at least that’s what this quote from the article leads me to believe:
I got ahold [sic] of the Copilot+ software and got it working on a system without an NPU about a week ago
The regular Copilot (without the plus) that sits in the taskbar was rolled out in an update about a month or two ago.
Also, this part of the article gives a method to check if it’s running:
Q. How do you obtain the database files?
A. They’re just files in AppData, in the new CoreAIPlatform folder.
Unfortunately there are at least two AppData folders (three to be exact, but one of them is rarely used), and it doesn’t specify whether it’s
%APPDATA%or%LOCALAPPDATA%, but I just checked on my Windows machine (Win11 with all updates installed, including Copilot), and I can find no such folder in either of these paths.EDIT: the video in this toot clearly shows the location of the database folder, and it’s in
%LOCALAPPDATA%, which makes sense given that it’s stuff that’s not supposed to leave your device.EDIT2: this tweet seems to confirm that this is indeed a feature that’s only shipped on certain new devices, which need to be specially certified because Copilot+ requires hardware support.
From The Verge’s obsequious article:
Recall won’t work with every Windows 11 computer. You’ll have to buy one of several fresh new “Copilot Plus PCs” powered by Qualcomm’s new Snapdragon X Elite chips, which have the neural processing unit (NPU) required for Recall to work.
And from the article in the OP:
I got ahold of the Copilot+ software and got it working on a system without an NPU about a week ago,
What even is a NPU, if it’s not necessary for the software to work?
Most of the newer CPU’s have an NPU already, Microsoft just set a higher performance requirement for NPUs to be officially labeled an “AI PC” which they are pushing hard.
They are using that to sell NPU bullshit to the stupid people crazy enough to be excited by it.
Then down the road they’ll push it in an update for everyone, I wager.
deleted by creator
Does anyone yet know how to break stuff like Copilot?
I don’t have Win11, but I also never really trust that MS won’t surreptiously push this kind of thing in the background to legacy systems, and I don’t trust UI toggles within Windows to actually do anything.
Do we know if there are services or files that Co-pilot needs to function?
Do we know if there are services or files that Co-pilot needs to function?
Co-pilot requires windows. I’m going to try Linux Mint and see how that goes.
Couldn’t you use a separator to make it one line of code? That way it’d be even more dangerous
Are you… Are you saying EVERYTHING can be hacked with one line of code?
Ever since those Aliens brought us their ancient and mysterious line separator tech, we have all we need to do just that!
Independence day was indeed a great movie. Who would have thought they also use X86 architecture?
I did an interview where the candidate said that if it’s one line, it runs in constant time. And they were completely serious. And this was in the context of Python list comprehensions.
They claimed this ran in constant time:
new_list = [value for value in my_list]Whereas this ran in linear time:
new_list = [] for value in my_list: new_list.append(value)We asked clarifying questions, like what happens to the runtime if the list gets really large, and they doubled down.
And this was for a senior Python dev position… No, they didn’t get the job.
Runs in constant time doesn’t ring a bell to be honest…do you mean instantly?
No, constant time means it’ll take the same amount of time whether you have 10 items or 10,000.
A list comprehension will take roughly the same amount of time as a for loop, it’s just syntactic sugar.
deleted by creator
Thanks!
Not sure why you needed to downvote my honest question, maybe the candidate dodged a bullet there, he he he.
I didn’t downvote.
If this was a junior candidate or something, I may have let it slide. But this was a senior candidate, which means they are supposed to be a technical leader for the team. I can’t have someone in that role with such fundamental misunderstandings. There were more red flags than just that one, I also don’t fail people for one gaff (e.g. I just passed a senior that bombed the coding challenge, but it was obvious they were over-thinking it).
thanks Microsoft
pleasetellmeyoucaninferthesarcasmfromthispost
They OCR the entire screen and store it in plaintext?! There is no way… I know it’s Microsoft we’re talking about, but are they really this stupid?
It’s encrypted; the author is pointing out that it has to be decrypted to be used, and then the data can be obtained.
Security and privacy concerns aside, I saw someone commenting on the use case, asking who would ever want something like this.
One problem I hadn’t appreciated for a long time was that some people apparently have real problems with dealing with the Windows UI in terms of file access. They don’t know where their data is being saved. This, in my opinion, is in significant part a Microsoft UI problem induced by various virtual interfaces being slapped on top of the filesystem (“Desktop”, “My Documents”, application save directories, etc) to try to patch over the issue that the filesystem layout was kinda organically-designed in a kind of cryptic way back in the day.
But if you can remember a snippet of text in what you were working on, you can find that thing again even if you have no idea where you stored it. Like, it’s content-keyed file access.
That’s not very useful to a techie. They know how to navigate their system’s filesystem, and even if they lose track of a particular thing, they know how to use the system’s filesystem search tools to search for filenames or content. They can search for recently-modified files. They know how to generally get ahold of stuff.
But for the people who can’t do that, reducing their interface to a single search box might make file access more approachable.
Now, let me reiterate that I think that a whole lot of this is Microsoft repeatedly patching over UI problems they created in the past rather than fixing them. And they’ve done this before over the decades with stuff other than document access. It’s hard to navigate the filesystem to find an installed program a la the MS-DOS era, so they stick stuff in a Start Menu to make it more accessible. That gets too crowded, installers start slapping shortcuts on the desktop. That gets too crowded, installers start adding system tray icons. That gets too crowded, the Start Menu becomes searchable. Each interface just becomes progressively less-usable and the solution each time is to stick a new interface in on top of the old one, which in turn contributes to the complexity of the system as a whole.
But that doesn’t mean that they aren’t trying to address a real problem.
I think that they’d do better with something like having a rapidly-accessible log of recently-accessed files (like, maybe have the filesystem maintain a time-based doubly-linked list of those) and be able to rapidly search the content of documents based on mod time so that recent stuff gets hit quickly, then trying to make their existing search tools more accessible. That doesn’t replicate data across the system and produce some of the problems here. It also permits for fully-searching content, rather than just the stuff that was on a screen when the Recall system grabbed a screenshot and OCRed it. Maybe they’ve done something like that in recent years; I’m many years out-of-date on Windows.
I’d also add that I think that personal computer systems in general would benefit from giving users better control over where their data is replicated to. It’s kind of confusing…you’ve got swap (well, encrypted swap probably helps somewhat with this). Browser history. Any clipboard manager’s retention. Credentials stores. Application-saved copies of in-progress files. Various caches. If you use some kind of cloud-based storage, you’re pushing data out to other computers. Backups. Just a lot of state that can be replicated all over the place and is hard to go back and track down and remove. That’s even before stuff like issues with doing secure deletion on existing filesystems (which we had a conversation about the other day, everything from log-structured filesystems to wear-leveling on SSDs inducing data replication). If you want something definitely gone, be able to manage your data’s lifetime, something that I think that a lot of people – even non-techies – would like, you really have to have a lot of technical knowledge of the system’s internals as things stand today. This Recall thing is egregious, replicates data all over, but it’s far from the first feature that makes it harder for people to understand and control the lifetime of data on their computer.
I don’t think that the software world has done a great job of letting people control that data lifetime. And I think that it’s something that a user should reasonably be able to expect out of their computer.
There was an article going around a while ago that was arguing most users these days, including the youth we often stereotype as “digital natives” who “get computers”, don’t understand file systems. They might not even know they exist as a concept.
Which makes sense if you’ve only ever really used modern UIs. You don’t have to know anything about files and folders. I bet a lot of people don’t even know they exist in any meaningful way.
Most users are shockingly ignorant, and a lot of them are not really paying enough attention or interested enough to learn much.
I don’t think any of the UX problems you’re describing have been solved on any platform. If anything Windows is one of the better examples here, because I’ll be fucked if I can ever find a file on Android and don’t get me started with Linux.
You think this is easier to use than grep?
With the tab-completion in Powershell, for someone who doesn’t know all the grep flags by heart, it might be easier to stumble through the options to find the ones you want without looking it up.
But it doesn’t list them does it? With e.g. zsh I can have the list of flags alongside their explanation, which is not the case with PS I think? I think even bash has it on more recent distros (not entirely sure)
Looks like you can use Ctrl+Spacebar to open the “MenuComplete” function that should show you the different available options. I don’t think you can get a direct list of the parameters that have explanations without using something like Get-Help though.
More info here:
No, neither is easy to use. The second you have to use a terminal or command line you have completely lost the vast majority of people.
I agree, but are you then implying that the windows explorer file search is good? Have you ever used anything else?
I didn’t say it was good, but it is easy to use compared to a terminal. It won’t help you find your file, but it’s somewhat intuitive to a novice user - you click around and open folders until you find something that looks like what you’re after. It’s not efficient, it’s downright tedious, but it’s at least easy to do.
It’s all about the barrier to entry to novice users. Most users are novices, they’re the majority of the market so they’ll decide what the market leader is.
My daughter certainly doesn’t have a good understanding of file systems even though I’ve been trying to teach it to her.
We recently went through a nuke-n-pave on my kids desktops. I plugged in an external drive for them to do backups, and we walked through the process. This was in Fedora with pretty much default Gnome tools. They came away understanding the process and how to track it, but I think they still don’t really understand file organization.
These kids grew up with tablets and smartphones where they don’t even see the file system, so I’m not shocked.
I remember reading an article a few years back about physics undergraduates who didnt know how to use a computers file system. They could learn, but these are smart likely at least fairly tech inclined kids and they didnt know how to navigate folders on a computer at 18.
When I studied Computer Engineering, I met several other students who had a lot of trouble using the Windows file system, and navigating a file system through a terminal was a Herculean task for them.
Most people growing up now, and since over a decade ago, are only tech savvy in the sense they know how to use smartphones, tablets, and social media; none of those require any understanding of file systems, and even using desktops doesn’t really require it that much for most people.
I can use file systems on terminal with my eyes closed, as long as it’s not windows because every release they change everything around. You’re victimising the victims.
Eh? Nothing significant has changed about the windows file system in over a decade, at least not from a user standpoint.
Most people don’t need to muck about in ProgramData, Program Files vs Program Files (x86) is pretty minimal, though admittedly you may need to check both if you’re unsure which the app you’re using is. I suppose %appdata% has changed, and one could argue it was significant, but in all honesty the concept of local vs remote should get you where you’re going, and worst case you check both.
But the base directory structure has been pretty static for a long while now.
Makes sense, I haven’t booted windows since 2013 and couldn’t be happier
I still stand by my statement: windows filesystem changes too often.
I’m simply baffled that someone going into a computer engineering major at a university doesn’t understand a hierarchical file system as a matter of course. It’s a tree. The file system is a tree. A tree is one of the most basic computer science logical constructs. How exactly is a filesystem confusing? How is navigating directories from a terminal - any terminal, in any OS - a Herculean task?
Someone going into the subject may not have any pre-existing knowledge of the subject (like what a tree is) and may be intending to learn it from their classes. Unless we require everyone to take a class that covers it first, you can’t really guarantee that people have that knowledge. While people may have known it by necessity before, computers, for better or worse, have gotten easier to use for the average person and it’s no longer essential knowledge. Or they may not have even be using a traditional desktop/laptop OS that has those concepts.
As for how it’s confusing, have you seen the default UI for Google Docs/Sheets/Drive or Microsoft Office recently? Google’s products default to a file view listed in most recently used order with a search bar at the top, no folders. The Microsoft Office suite defaults to saving to OneDrive without any folders. If this is all people have needed to use when growing up, is it any wonder why they never learned about hierarchical folders in a filesystem?
Yeah this is why Apple has been slowly peeling away traditional file / folder features from front and center. The user doesn’t care where or how they get their files, they just want them at any given time. Spotlight being the most successful at obfuscating where anything is yet allowing access to everything. Microsoft has started to pick up on that and attempt to solve the same problems.
The bizarre thing is, they have solved it. PowerToys Run is the Spotlight omnibar of everything and they bizarrely haven’t chosen to bake it into Windows proper. I can’t use Windows without it now. Search files and folders everywhere faster than the start menu search, search running processes, execute commands, do maths, calculate hashes, open web pages. It’s fantastic.
Do you use windows by choice or for work?
Both. I’m one of those weird people that uses Linux, macOS, Windows, Android, and iOS on a daily basis (Android probably less than daily now as I’m not travelling as much as I used to). My job necessitates it but also I just enjoy having mixed estates at home to stay fresh. I am, however, eager to stop using Windows at home as the overall security health and conscience of Microsoft these days seems to be trending downwards.
Windows hasnt quite felt as risky as it does now, that I can remember at least.
Luckily my company outsourced the IT security department to India and have since had a handful of breaches and zero remediation efforts. I’m sure this windows stuff is firmly in the “care later” bin.
I don’t think that the software world has done a great job of letting people control that data lifetime. And I think that it’s something that a user should reasonably be able to expect out of their computer.
That’s true.
I once thought about this, that maybe it’s a good idea to use a tagged and maybe log-style filesystem, where 1) every directory name in file path becomes a tag for it, other than the user-added tags (which can be searched separately), 2) there are temporary and permanent files, where temporary ones are deleted once their lifetime passes or that plus once the space is required, while permanent ones are stored indefinitely, 3) with hardlink functionality transparently available to the user, from the GUI, 4) the GUI itself should drop the bullshit and return to DOS times in the sense of control - with this thing I describe it may well be that the casual user won’t feel as lost as they do now.
Maybe (again, transparent and user-accessible) filesystem overlays for every application are a good idea too here, like with Docker, chroots, MacOS DMG images, etc.
In addition to that indexing file contents may make sense too, like you said.
Frankly there are so many good things one can do which haven’t been done, before just OCR`ing everything on the screen and storing it.
About “why MS chose this” - because they consistently choose the dumbest and ugliest way to deal with any problem. The heaviest artillery available, to look relevant.
Offtopic - the searchable start menu problem is what scares me off Gnome every time I try it. You just get that tablet-like one-level place with a search field and icons. A frigging lot of fscking icons for every dot-desktop file Gnome found. Then I panic and get back to FVWM.
As a species we have invented something called “indexes” that solve exactly that kind of problem. We actually have an entire field of science called information retrieval, that doesn’t require screenshotting your whole life to produce the same result.
I completely agree with this. I work as a User Experience researcher and I have been noticing this for some time. I’m not a traditional UX person, but work more at the intersection of UX and Programming. I think the core problem when it comes to discussion about any software product is the people talking about it, kind of assuming everyone else functions the same.
What you mentioned here as a techie, in simple terms is a person who uses or has to use the computer and file system everyday. They spend a huge amount of time with a computer and slowly they organise stuff. And most of the time they want more control over their stuff, and some of them end up in Linux based systems, and some find alternative ways.
There are two other kinds of people. One is a person who uses the computer everyday but is completely limited to their enterprise software. Even though they spend countless hours on the computer, they really don’t end up using the OS most of the time. A huge part of the service industry belongs to this group. Most of the time they have a dedicated IT department who will take care of any issue.
The third category is people who rarely use computers. Means they use it once or twice in a few days. Almost all the people with non-white collar jobs belong to this category. This category mainly uses phones to get daily stuff done.
If you look at the customer base of Microsoft, it’s never been the first. Microsoft tried really hard with .NET in the Balmer era, and even created a strong base at that time, but I am of the opinion that a huge shift happened with wide adoption of the Internet. In some forum I recently saw someone saying, TypeScript gave Microsoft some recognition and kept them relevant. They made some good contributions also.
So as I mentioned the customer base was always the second and third category. People in these categories focus only on getting stuff done. Bare minimum maintenance and get results by doing as little as possible. Most of them don’t really care about organising their files or even finding them. Many people just redownload stuff from email, message apps, or drives, whenever they need a file. Microsoft tried to address this by indexed search inside the OS, but it didn’t work out well because of the resource requirements and many bugs. For them a feature like Recall or Spotlight of Apple is really useful.
The way Apple and even Android are going forward is in this direction. Restricting the user to the surface of the product and making things easy to find and use through aggregating applications. The Gallery app is a good example. Microsoft knew this a long back. ‘Pictures’, ‘Documents’ and all other folders were just an example. They never ‘enforced’ it. In earlier days people used to have separate drives for their documents because, Windows did get corrupted easily and when reinstalling only the ‘C:’ drive needs to be formatted. Only after Microsoft started selling pre-installed Windows through OEMs, they were able to change this trend.
Windows is also pushing in this same direction. Limiting users to the surface, because the two categories I mentioned don’t really ‘maintain’ their system. Just like in the case of a car, some people like to maintain their own car, and many others let paid services to take care of it. But when it comes to ‘personal’ computers, with ‘personal’ files, a ‘paid’ service is not an option. So this lands on the shoulders of the OS companies as an opportunity. Whoever gives a better solution people will adopt it more.
Microsoft is going to land in many contradictions soon, because of their early widespread adoption of AI. Their net zero global emission target is a straightforward example of this.
Do you really need screen snapshot to do fine grained search though? It sounds like you’re describing Spotlight in some way https://en.m.wikipedia.org/wiki/Spotlight_(Apple)
With recall you can search for a website you saw once, a link in a discord channel, an email all at once in one place.
They’re a surveillance capitalism corp first and foremost. All other considerations, including security, are secondary.
deleted by creator
The damage is mitigated by the fact it only recalls last 3 days by default
deleted by creator
“By default” meaning it can be changed.
Then someone in the company gets their device compromised, and security starts looking what happened on the device that time. “We’d have that data, but it was deleted yesterday because of the retention policy on recall” -answer from that new guy in IT dept. Security then reminds that the company policy requires minimum 30 days retention for all logging of security events.
Forensic data recovery. How many 500GB drives ship to PCs that never use more than 20% of that?
Can you elaborate on what “subpoenable information” means. Like I have a vague idea but im not super clear if thats like a legal term with special considerations or whatever. Elaboration would be helpful.
It means it’s the kind of stuff that law enforcement would require a warrant in order to obtain.
If you’re suspected of something and law enforcement can get a subpoena, you’ll have to hand over the contents of your microsoft keylogger, actually microsoft will hand over your contents from their keylogger.
Not OP but the scenario described is say… A company and a specific manager gets sued for harassment. The plaintiff can be entitled to discovery related to the complaint, and that could now include the searchable screenshot database from the managers computer showing all the clear evidence that he harassed the plaintiff. Nightmare scenario for legal departments of companies.
deleted by creator
On the other hand, this makes it much easier for a corporation to spy on its employees, so I think at least some of them are in favor of this.
If employees are using the corporate’s computers, they can already see everything the employees do, they don’t need this new window feature to do it
That is by no means necessarily the case. For example, if a notebook is taken into the field and is not on the LAN.
A lot of companies are implementing better VPN tech (like SD-WAN, Nebula by Slack, etc), or at the least Microsoft Intune to ensure your corporate laptop is reachable anytime it’s connected to the internet.
Windows has some kind of built-in VPN feature that auto starts and will otherwise not give you any network access. Add on top of that some corporate firewall and you basically can’t sneeze around your laptop without IT knowing.
My work laptop is a brick until it establishes a VPN tunnel back to the home network. There are ways to ensure the device only works how the company wants it to.
Hmmmm it depends… Are they going to make more money by spying on employees than they’ll lose in lawsuits?
I think COVID WFH policies proved the majority of us do not need someone breathing down our necks to perform
And yet management is desperate to end WFH policies and has done so in many companies.
To justify their own existence
deleted by creator
The article references family, domestic violence, employers, and fraudsters but doesn’t really focus on legal liability.
deleted by creator
deleted by creator
Before you said that it was specifically addressed. Interesting shift of the goal post.
deleted by creator
No major corp I’m aware of is excited about these changes. Legal especially would like there to be the minimum records retention required by law, and a months long AI searchable database of individual user actions on a PC is a nightmare scenario for them.
If the IT departments of any major corp allows anyone within their network to enable this feature, they and everyone the work for need a permanent waning label for idiocy and utter incompetence attached to their resume.
I don’t know, if I was IT decision-making and I worked for a company I didn’t particularly like I might install this for the executive stratosphere and hope for subpoenas.
Can I forward your comment to my IT team? Because they’ve done worse than that already :(
I’m really hoping valve does a public steamdeck OS release. I’d like to replace windows on my PC with Linux and have windows as a backup, but the Linux distro I’m the most familiar with is the steam deck’s distro, and that’s not available outside of steam decks yet.
Check out bazzite.gg
It is a very beginner friendly, gaming focused distro that essentially aims to be steamOS on PC. It even has rollback functionality if you accidentally break something.
You’re gonna get lots of suggestions, lol.
I’d say look at Zorin. It’s a Ubuntu-based distro so it has lots of support, and also has several baked-in themes to customize your desktop the way you want it right out of the box. You can make it look like Windows 7/10/11 or macOS without any other apps or themes, which might help your transition.
deleted by creator
Zorin is excellent!
Bazzite has been designed to be an out of the box SteamOS distro. It’s not based on Arch, so if that’s what you’re familiar with then that’s not the same, but give it a try.
SteamOS is arch based and uses KDE Plasma as the default DE, so you could probably run Endeavour OS and be pretty darn close
Even supposing I didn’t care about the security implications of this, why on earth would I want this functionality? I can barely keep up with all my activities in the present moment, let alone the past. It’s like a morbid and pathological unification of nostalgia and hoarding.
I get the security issues, sure, those are valid, but the privacy ones are even worse. Imagine a teenager trying to search information on being gay, or possible intrusive thoughts on their family computer, only for their super maga right wing parent to find it in the screenshots.
Or someone being abused at home and searching for support facilities, deleting history and being outed by recall.
Wait, how about credit card fraud as a result of EVERYONE who has access to this computer can read your cc data?
Or, my husband was looking at jewelry online yesterday and he hasn’t told me, he must be cheating, right? Oh sorry, I forgot, our anniversary is next week… Hahahaha, don’t be upset babe.
Best one ever though, imagine your search history, your porn watch history accessible to anyone with access to your computer? The fucking horrific existence of having an employer process this data at scale using fancy staff monitoring program 7, and run stats on the fact that you had a toilet break while working from home, and they want to know if it was a number 1, or a number 2 so they can work a mean time to shit metric into your KPA/scorecard.
Guys, whatever benefit you think this is. It’s not worth it.
Not that it solves the problem, but since I’m not the King of M$ this is about all I can do: you could easily get around all that by turning off secure boot and booting into a persistant live-usb containing a linux distro of your choice (Tails for extra privacy/ease, if you can use Tor) to do all your secret agent computing needs. The host PC can’t see shit of what happens on Tails.
Edit: lol you downvoted me because I can’t singularly change an entire corporation’s mind and instead offer workable solutions that you could make within the next 30 minutes to mitigate the problem until such time as your plan for Microsoft domination comes to fruition and you can change it back?
Ok I guess, “chump don’t want no help, chump don’t get no help. Jive ass fools ain’t got no brains, anyhow.”
-Barbara Billingsly
Ultimately privacy is part of security so, if anything, everything you mentioned is just more reinforcements that this is a major security concern.
As someone that has been obsessed with tech since being a kid in the 90s I think the tech side of this is super cool and very exciting stuff. As a user, though, I only like this if I’m the one implementing and using it. I do not trust a mega corporation (or really any company) to “leave it locally on my computer and totally not use that data for other purposes”. Right now it’s supposed to be (as far as I last heard) only on your machine but we’ve seen EULAs and TOS’ etc change many times over the years but especially over more recent years as data continues to be king and data like this is a literal bottomless diamond mine.
I know this isn’t your point but it’s just worries I have in addition to your points. And let’s not even start about what this means for law enforcement abuse. No thanks, I’ll wait for a FOSS equivalent that at least gives me and the community the opportunity to evaluate how it works.
Microsoft, stop giving me Red Star OS flashbacks. (If im not mistaken, it records your screen and stores it in a police-only folder)
It’s basically the same shit at this point
I keep hearing all the rabble rousing about this from a security perspective, but is there not an incognito mode to the Recall capability?
There cant be.
It literally screenshots what you’re doing every few seconds, and builds a plain text database of any and all text it captures.
Incognito mode is not having it installed.
Hmm that didn’t sound right so I had to look it up. Microsoft says there’s a way to pause the recall snapshot functionality for a set amount of time, like an incognito mode:
Pause or resume snapshots To pause recall, select the Recall icon in the system tray then Pause until tomorrow. Snapshots will be paused until they automatically resume at 12:00 AM. When snapshots are paused, the Recall system tray icon has a slash through it so you can easily tell if snapshots are enabled. To manually resume snapshots, select the Recall icon in the system tray and then select Resume snapshots.
I don’t understand why there’s so much FUD around this product…
You don’t understand why there’s so much fear, uncertainty, and doubt about an on-by-default program that records everything you do? Are you being serious right now?
I find it hard to take seriously anyone who throws the term FUD around with no sense of irony.
Yeah not to be obtuse here, but I think the fear is over sensationalized. I haven’t seen it in person, but it seems like this is a totally new product that is similar to idea of browser history, but adds in some modern features. I would like to check it out.
on-by-default
That’s not correct. Based on the documentation, Windows Setup has an option to enable/disable the feature on first boot.
The documentation also says it doesn’t capture incognito windows and I mentioned in my other comment that you can turn it off temporarily and permanently. It doesn’t run all the time no matter what, like some of the comments have suggested.
Here’s a screenshot of the config page with a simple toggle to turn off:
Windows 11’s Recall feature is on by default on Copilot+ PCs
Disabling the AI snapshotter requires a trip into Settings for ordinary users
Over the weekend, The Verge’s Tom Warren posted (on twitter) screenshots showing Microsoft’s latest Out-of-Box Experience (OOBE), in which the Recall feature can’t be turned off unless the user opens Settings after completing setup.
Now, it’s possible things have changed in the last few days, but I wouldn’t really expect them to based on the last time I used windows. I also didn’t know this before I tried looking it up, so I’ll admit I’m a little biased against microsoft.
But the real question is, what documentation are you looking at where you’re pulling all this information from? Can you provide a link?
As reasonable the concerns are… it seems like there’s quite a bit of fearmongering over software and hardware that haven’t even really gotten into the mainstream yet.
The writing style is a bit weird, but I think the concerns are valid. That sqlite file is a treasure trove for hackers/scammers.
Do you think it would be a better idea to wait until it’s installed and active on every Windows computer before we start a discussion on how bad Copilot is?
Only computers that can run it… are pretty much none of the computers running 11 today. The CPU needs to have an NPU, as the AI functionality is run locally on the PC.
Go look at all the Windows PCs announced in the last few months and you will see they have NPUs. So again, why would we wait until it is too late to try to stop this nonsense?
Also the “AI” may run locally but it saves the info into an easily accessible and readable SQLite database in the users AppData. It will be trivial for malicious actors to access.
@Blaster_M @Spuddlesv2 Apparently you can run it in an Azure ARM windows VM. Wanna try?
I heard this same argument from people all the time. Until it affects you in a meaningful way to change your mind, it’ll be too late.
Agreed that there is a bit of exgaerated dread… but honestly this has all the hallmarks of a monkey knife fight in an elevator, it’s hard to imagine how this won’t end in disaster
I’m just imagining a monkey knife fight in an elevator now… They are cartoon monkeys btw.
I have no idea what a monkey knife is. Monkeys with knives… knives made of monkeys… pejorative… metaphorical…
AI monkeys with knives and their fingers are truly scary to behold.
And you can’t tell where the knife ends and the fingers3 begin.
And they have the wrong number of fingers and knives.
This is a feature hundreds of millions of people will use and very likely won’t cause any security issues. These doomsday scenarios every Linux user here is predicting is a bit much, don’t you think so?
We’ve seen it before, it’s not idle speculation. Windows machines have been the hosts of the largest botnets in the world. Whenever a company does something stupid like this it invariably gets into the wrong hands. It’s not even a question of if it will happen just when it will happen.
Oh and it’s not “Linux users” saying it, it’s everybody with an ounce of technical common sense. We’re all here shouting at Microsoft “it’s a bad idea” and they won’t care and it will go exactly as badly as predicted.
Oh and it’s not “Linux users” saying it, it’s everybody with an ounce of technical common sense.
Which kinda correlate with each other. Which allows for a certain bad faith argument to be made.
Yes, we have seen it many times before. Much ado about nothing. New feature that will mean some new security measures. Everybody will move on and in a year nobody will remember how some people in the Linux community were panicking.
I will never find out exactly when your bank data is stolen because of this, so I’m just going to laugh about it now.
Go ahead laugh. Because you will indeed forget all about it and never remember your doubts and panic laughter as nothing will happen.
very likely won’t cause any security issues.
Hahahahaha. Oh wait, you’re serious? Let me laugh even harder. HAHAHA
You are the clown with a sign: the end is nigh. You are being naive.
You’re being exceptionally - and genuinely stupidly - naiive.
Sure. Why not. These hysterical people here panicking are the chosen ones that know and understand everything.
Are you braindead? Yes yes taking regular screenshots of the desktop can’t possibly be a security risk, right?
You can define almost anything as a security risk. But we aren’t children to play such stupid games.
We are talking about someone gaining that information and the probability of that happening without even knowing what security mesaures will be in place. I think the risk is negligible even today with the limited information about it that we have now. Other People here, presumably you as well are hysterical about it.
Thats what the discussion is. You actually believe Microsoft will launch this and then everybody will be hacked or something. I think that is… not smart.
No, I don’t think “everyone will get hacked or something”, don’t put words in my. I mouth for the sake of your argument.
What it is, and this is undeniable, is a massive fucking privacy and security hole if someone gains control of your computer.
I didn’t want to put words in your mouth, but wanted to clear up where each of us stand so there is no missunderstanding.
If somebody gains control of your computer today, that’s a massive privacy and security hole in itself.
Absolutely, but even with control of your computer, if you’re smart, other accounts etc will still be inaccessible by the attacker.
Not when they get access to the Windows built in desktop spy saving everything it sees.
Not if it’s encrypted and if sensitive information is not saved.
Main point is still that gaining control of someone’s computer against their will is practically impossible today. If someone manages to do it, they already have your files and all the sensitive information they could want. They won’t even bother with this recall. And if you are worried about it, you will be able to just turn it off.
Much ado about nothing.
“If sensitive information is not saved” is doing a lot of heavy lifting for you there. The issue is that it saves everything.
If you didn’t want to put words in someone’s mouth then you shouldn’t have said something like
You actually believe Microsoft will launch this and then everybody will be hacked or something.
Oh a knight in shining armour trying to defend my dialogue partner?
Did you ask anyone needed defense? Because I’m pretty sure they don’t.
If you read carefully I wrote “or something” at the end implying that I don’t know exactly what they believe. It was not that subtle of invitation for them to agree with my first assessment or correct me. I will try to be really blunt in the future, so that you don’t missunderstand again.
? I’m not defending anyone, I’m calling out bullshit when I see it
I don’t really care that you like watching kids through their bedroom windows or whatever
If that doesn’t accurately describe your views, no worries—I said “or whatever,” so it’s fine
Did you read the article?
This system basically do a character recognition on EVERYTHING the user is displaying and save the results in a very small file not that well protected.
The data is very small (I guess because it’s basically text?), seems easy to find. That means the history of all you did on your computer (apparently only for the last three feays by default,but well…) can be stolen at once, in a minuscule file.
I’m not an IT specialist, but I don’t see in which world this can remotely be a good idea…
As I understand not everything will be read and stored, storage will be encrypted. We don’t even know what exactly will be stored and everybody here is losing their mind.
We already have a lot of sensitive information on our computers and nobody is panicking.
I guess it’s hard to get used to new stuff. Or maybe Linux users are afraid that their favourite system won’t be able to compete anymore.
Based on what Microsoft themselves said we know: everything will be stored (except edge private session…). They specifically say they don’t do content moderation: they log everything.
Did you read the article?
Q. Cool, so hackers and malware can’t access it, right?
A. No, they can.
Q. But it’s encrypted.
A. When you’re logged into a PC and run software, things are decrypted for you. Encryption at rest only helps if somebody comes to your house and physically steals your laptop — that isn’t what criminal hackers do.
As a windows user I’m not delighted by this.
Edit: at this point you must be trolling…
If you are so afraid, you can just turn it of. You are aware of this are you not?
OK if you think I’m trolling, why did you answer?
I give you the benefit of the doubt you are a reasonable person who can go beyond their emotions of a feature of an os. And the emotions this article stirred.
You didn’t read the article.
We do know the answers to these questions. And if I can use a 2 line script to exfiltrate all your screen data for days/weeks in under a few MB of data.
So better hope you, never, ever, ever run unauthorized or malicious code, because now it basically has a honeypot of top priority data, always stored in a known location and compressed for easy uploads.
What kind of malicious code would be able to do that?
Q. The data is processed entirely locally on your laptop, right? A. Yes! They made some smart decisions here, there’s a whole subsystem of Azure AI etc code that process on the edge. Q. Cool, so hackers and malware can’t access it, right? A. No, they can. Q. But it’s encrypted. A. When you’re logged into a PC and run software, things are decrypted for you. Encryption at rest only helps if somebody comes to your house and physically steals your laptop — that isn’t what criminal hackers do. For example, InfoStealer trojans, which automatically steal usernames and passwords, are a major problem for well over a decade — now these can just be easily modified to support Recall. Q. But the BBC said data cannot be accessed remotely by hackers. A. They were quoting Microsoft, but this is wrong. Data can be accessed remotely. Q. Microsoft say only that user can access the data. A. This isn’t true, I can demonstrate another user account on the same device accessing the database. Q. So how does it work? A. Every few seconds, screenshots are taken. These are automatically OCR’d by Azure AI, running on your device, and written into an SQLite database in the user’s folder. This database file has a record of everything you’ve ever viewed on your PC in plain text. OCR is a process of looking an image, and extracting the letters. Q. What does the database look like? A:https://twitter.com/GossiTheDog/status/1796218726808748367?ref_src=twsrc%5Etfw%7Ctwcamp%5Etweetembed%7Ctwterm%5E1796218726808748367%7Ctwgr%5E2eccf634534245a77c4f931d8722f1b8c6f23595%7Ctwcon%5Es1_&ref_url=https%3A%2F%2Fcdn.embedly.com%2Fwidgets%2Fmedia.html%3Ftype%3Dtext2Fhtmlkey%3Da19fcc184b9711e1b4764040d3dc5c07schema%3Dtwitterurl%3Dhttps3A%2F%2Fx.com%2FGossiTheDog%2Fstatus%2F1796218726808748367image%3D Q. How do you obtain the database files? A. They’re just files in AppData, in the new CoreAIPlatform folder. Q. But it’s highly encrypted and nobody can access them, right?! A. Here’s a few second video of two Microsoft engineers accessing the folder: https://cyberplace.social/system/media_attachments/files/112/535/509/719/447/038/original/7352074f678f6dec.mp4 Q. …But, normal users don’t run as admins! A. According to Microsoft’s own website, in their Recall rollout page, they do: https://miro.medium.com/v2/resize:fit:1100/format:webp/0*WGE1jcRzhe6WAGQS In fact, you don’t even need to be an admin to read the database — more on that in a later blog. Q. But a UAC prompt appeared in that video, that’s a security boundary. A. According to Microsoft’s own website (and MSRC), UAC is not a security boundary: https://miro.medium.com/v2/resize:fit:1100/format:webp/1*TTjYNH15IoP_d8JhhG3cEA.png Q. So… where is the security here? A. They have tried to do a bunch of things but none of it actually works properly in the real world due to gaps you can drive a plane through. Q. Does it automatically not screenshot and OCR things like financial information? A. No: https://miro.medium.com/v2/resize:fit:1100/format:webp/1*OZMjujpALL3IfAQYT64x7Q.pngDo I have to continue or do you think you could actually read the article for the rest? It’s clearly a bigger deal than “linux users mad because windows better” and your poor excuse for a troll just makes it look like you’re too stupid to read the article laid out in front of you. Well, now you have no excuse so get good.
Sorry I don’t take everyones word as truth. This guy is just one guy. One guy against the whole Microsoft corporation whose entire fortune depends on this not to fail in the way he said it certainly will. Absurd.
Lol you’re hopeless.
Then don’t believe one guy, read the other reports on the feature, or the reports from Microsoft’s BUILD conference that confirm these details.
It’s stored in the appdata folder in plaintext.
Encryption at rest is meaningless if you get infected with spyware.
Oh it WILL cause security issues. It’s just a tradeoff against if they are worth the benefits.
There likely won’t be anything major while 1. 4 billion people will benefit. Security measures will be adapted for this new feature.
This same thing happened before, a lot of panic for nothing.
Define “new security measures”
I don’t know. We will both be able to discover them when the features are deployed.
This is a senseless hysteria about how this is horrible and… I don’t even want to go into all the dumb shit I read.
Unpopular Opinion: This is why Microsoft were such assholes about making sure Windows 11 required a modern TPM and this is also why they are forcefully rolling out Bitlocker encryption turned on by default on all Windows 11 PCs.
Is Recall still a fucking stupid idea? Yes, resoundingly so. But they’ve half-ass considered the risks, it seems. The forceful rollout of Bitlocker is dumb and short-sighted in its own right, and it wouldn’t make a person completely secure from outside attacks rooted in a Recall exposure.
Hardware controls are meaningless if an attacker gets you to click on a dodgy link in a phishing email or you fall for a social engineering scam when “Microsoft” calls you because your computer has a virus.
Theoretically, Microsoft could protect against most attacks. Apple has done it by making it increasingly impossible to touch kernel level stuff without an MDM. Every release they lock up more of the system. It means they are drifting toward iOS on their Macs, where the user doesn’t own their device, but it is an effective blocker to stuff like this, baring zero day kernel issues.
I think that is where Microsoft is headed, but they also aren’t able to let go of backward compatibility, so they really aren’t getting any closer to a system that is secured enough to handle such sensitive data.
Most compromises live in user space. Locking down the kernel is great and all but “most attacks” are running as the logged in user doing operations that user is permitted to do.
Even on userland stuff Apple controls tightly. If they want to require a user to manually click, they will get that. If they want it to be a physical mouse and keyboard doing it, they will get that too. They own the device, and have complete control, not the user or “owner”.
I am shocked there is even a single downvote on this comment. parent is 110% right. a kernel level compromise in the vast majority of exfiltration events its just needless (but nifty) icecream on top of the pain pie being served to the user.
Umm, no. Just…yeah, no.
The main problem with this theory is that Microsoft is absolutely abysmal at user end security, and they always have been. Frankly, they do not understand the issue.
But, more to the point, the whole TPM/secure boot stuff is a compromise; originally (I think this was about the time of Vista), they partnered with OEMs to have them include a DRM chip that made it literally impossible to install any non-windows OS on your laptop. They’ve managed to still get an implementation of TPM that makes switching your OS too confusing/difficult for the average user.
Anyway, bottom line is they only care about money, and they neither care or even understand the security needs of the end user.
Nah dude. TPMs have always been about implementing DRMs. These companies hate that they can’t control our PCs, they want to be sure we can only run their approved apps. Like it works in iOS and (to a lesser degree for now) in Android. And even there they are pushing hard for even more restrictive DRM.
For example, some years ago I worked with a SaaS that implemented and sold some security products. One of our customers was a big retailer (for specialized products, not going into more details to avoid doxxing) that was having a problem with scalpers buying all their inventory as soon as they released it. So they were trying to put a show for regulators about stopping scalpers because their customers were complaining. We suggested that the only real solution was to have some real life verification of purchases. But in the end they went with the awful attestation APIs offered by Apple and Google to “fix” this. And in case you are not familiar, these APIs are just TPM based DRMs. So now, if you have a rooted/jailbroken phone you can’t even buy with this retailer anymore.
Note that this company wasn’t trying to fuck customers directly, they were just lazy and incentivised to not really fix the problem (a sale is a sale, even if to a scalper). But even then the end result is that their customers got their digital freedom rights restricted. It’s just a terrible technology IMO, the incentives from companies are all terrible. And that’s before we start considering the real intentions of awful companies like Microsoft, Apple and Google. IMO they are actually pushing for techno feudalism, but that’s my conspiracy theory hahaha.
So no, I doubt they were thinking about security with this recall bullshit. As other people have explained in their comments it doesn’t really protect much in practice. Plus this whole AI push has just been a stupid scramble from these companies to grab a big piece of the stupid AI pie from other companies hahaha, there is no long term plan here, don’t lie to yourself and us.
Because Windows not only encrypts the system disk (C:) but also all connected hard drives
And they’re gonna just enable it without asking if i want all my hard drives encrypted first?
Yes.
24h2 will explicitly be using it by default.
That’s not an unpopular opinion, it’s an outrageously stupid and uninformed one and you should keep it to yourself.
