4 ms·

I don't understand why people have such a big privacy issue with this. It all happens on your device. I understand being concerned about Microsoft using it to

• dr-detroit 2y ago
  [dead]
• ImAnAmateur 2y ago
  "It's already bad, I don't see why making it worse is a problem. It's just one more thing to worry about." There's more at stake here than passwords. These repeated screenshots are essentially a slow, silent video of all computer activity. That has far more information than you may think it does. It compromises HTTPS content, it records data that otherwise would only be in RAM, ...I could go on.
  • wilsonnb3 2y ago
    Please do go on, I am curious - what exactly is the threat you are seeing here?
    • cratermoon 2y ago
      I don't suppose you know any survivors of domestic abuse. If you do, ask them.
    • ImAnAmateur 2y ago
      Okay. Let's talk specifics. I log in to an end-to-end encrypted chat with a family member. We talk about life and the subject drifts to plane tickets we already bought for next month and how the neighbor across the street isn't going to be home until the end of this month. The thief who stole my laptop now has also stolen a recorded conversation along with my passwords. Now they know when two houses will be empty. This would not have happened without pictures of my screen being taken frequently.
      • brookst 2y ago
        So this thief has access to your filesystem, therefore your machine's passsword? You can't just pull out the hard drive and put it in another system, at least not with even just decent practices. But the thief will also have your browser history, any saved passwords, and so on?
        • shuntress 2y ago
          Obviously Microsoft isn't going to sell their profile of you to petty thieves. But they probably will sell it to at-scale-grifters looking for marks or fascists looking for dissidents.
      • wilsonnb3 2y ago
        Thanks for coming up with a specific scenario for me. I do agree that the outcomes in this case might be worse than an alternate universe without the recall feature. That said, if someone steals my laptop and can log in, I am already pretty fucked. There are so many other ways they could get this or other information, from email, calendars, etc.
    • bombcar 2y ago
      Even without everything else, a big threat vector is people not knowing better who have it on, and then give access to their machine not realizing what they've done.
    • nightowl_games 2y ago
      Total, constant, omnipresent surveillance feeding an AI model of every single individual that is so powerful that it can persuade us deeply and without our knowledge. Note: this is basically already happening. It's just the sad tripling down on advertising technology being our most advanced technology.
      • mrguyorama 2y ago
        >advertising technology being our most advanced technology. This is a huge distinction I want to point out: Nothing anyone has done in the past twenty years has been to make advertising more effective, though that is what is often claimed. The system however, only works towards making advertising more profitable to Google and Facebook. Everything else, including advertising effectiveness, has been slaughtered at the altar of "Gotta make line go up" inside Google and Facebook. Both companies benefit greatly if the amount you spend on advertising goes up because it's not as effective as it used to be. They also run most advertising as explicitly adversarial instant auctions, meaning the ad that runs before your Youtube video isn't the one most likely to get you what you want, or fix a problem you have, or even please your dopamine system, but rather the ad you see is primarily driven by who spends the most. This means that every midsized company that is so stupid as to misconfigure their advertising run will run a lot of ineffective ads, while the lean company doing innovative things locally who can only afford a "reasonable" ad spend will end up running far fewer ads. The system empowers those with deep pockets and silences those without. Intentionally. This also makes it pretty easy to keep your new competition from getting any oxygen in a market. I believe Google says that they include other things in the bidding process, including a specific claim that if you run a shitty ad that nobody every clicks on, it will be down-ranked in the ad auction, but they have billions and billions of reasons to not do that as effectively as they could. They are financially motivated to make advertising less effective and more expensive for consumers and producers alike.
        • yoyohello13 2y ago
          Everyone who has ever worked on ad-tech has made the world a worse place to live.
    • 5e92cb50239222b 2y ago
      Getting your doors kicked in because you posted "disinformation" on the internet, or said something "unpatriotic" to a rando on the street and got reported to the cops. You won't have time to lock your computer, or if you do, the password will be pulled out of you with pliers, along with a couple of teeth. It's a daily reality in some parts of the world, including my own country and another one where I have many friends.
• hn8305823 2y ago
  > I don't understand why people have such a big privacy issue with this. It all happens on your device. It's not hard to imagine situations where this complete and total information package can be exfiltrated or otherwise abused. Roommates, stalkers, one night stands, domestic govt, foreign govt, domestic hackers, foreign hackers, computer repair techs, employers (seizing a personal device), etc, etc etc. There is no scenario in a free society where this should be allowed or tolerated.
  • wilsonnb3 2y ago
    What else should not be allowed because of it possibly being abused? Should I not be allowed to use a password manager because it would be problematic if my roommate or one night stand copied it? This isn't fundamentally different to any other feature.
    • deleted 2y ago
      [deleted]
    • onemoresoop 2y ago
      > Should I not be allowed to use a password manager because it would be problematic if my roommate or one night stand copied it? You are free to use or not a password manager. What ms is doing is shoving things by force. It's not an opt in feature, their OS is becoming something ugly fast
      • Spivak 2y ago
        This just pushes the question, what else should be opt-in because it could be abused by someone given full access to your laptop? Saving browser history? Persistent logins? Shell history? Document recovery? Spotify listening history? This is why Windows has the "airtight hatchway" beyond which security against the user accessing their own data stops applying. Inside your login is by construction where your private data goes. Adding more of it shouldn't matter as it's all protected as the same. Like I agree that this feature is annoying but it's not a security risk, Windows promises no security against yourself.
• gryn 2y ago
  > It all happens on your device. any garantee on that ? or that will not change one windows update or two down the line ?
  • wilsonnb3 2y ago
    Just depends on whether you trust Microsoft or not, and I already mentioned in my comment that I understand concerns about the on device part potentially changing in the future.
    • akira2501 2y ago
      Files are stolen off of systems all the time. There is an unknown, but not zero, number of zero day exploits available _right now_ to do precisely this. This is very much "cart before the horse" corporate thinking.
• exitb 2y ago
  It’s trivially easy to turn this into an unprecedented surveillance mechanism.
  • vsuperpower2020 2y ago
    If that happens, I wonder if future generations will believe us when we insist that wasn't the intention; We just wanted a helpful AI that takes pictures of what you're doing every 5 seconds in case we forgot what chinese food place we like.
    • yoyohello13 2y ago
      "We" didn't want anything. Microsoft just makes decisions and most people have no choice but to go along with it.
      • vsuperpower2020 2y ago
        Pick any word you want. I don't care and that's not the point of my post.
      • fragmede 2y ago
        given the open source and proprietary implementations of this elsewhere, people actually do want this feature, even if you don't.
• Rygian 2y ago
  Can you explain, down to CPU instructions and network packets, what it is that "happens on your device"? If the answer is anything else than "yes, I'm the absolute world authority on that" then you don't know how or whether Microsoft is respecting your privacy (same reasoning goes for Apple, for Google, for mobile phone radio stack, …).
  • wilsonnb3 2y ago
    Isn't this just a general argument against closed source software and nothing specific about this recall feature? If you don't trust Microsoft then yeah I can see why you wouldn't want this feature but you probably aren't using Windows in that case anyways, so it is a moot point.
    • exitb 2y ago
      Up until recently, regardless of the source accessibility, certain things were just impossible. For example, a computer could not universally interpret and categorize what you’re using it for. Now it’s entirely possible, so naturally people’s attitudes change.
    • EasyMark 2y ago
      There are those of us who care about our spouses/children/family/friends and what this means for them, even it doesn't directly affect our daily lives. There is nothing wrong with our being concerned about that, and it doesn't make our opinions on the matter invalid.
    • Rygian 2y ago
      Late comment: have a look at https://news.ycombinator.com/item?id=40543990 https://news.ycombinator.com/item?id=40543990 What may be a moot point for me is not a moot point for millions of users. This feature seems to be enabled by default and needs poking into settings to disable. Microsoft have proven time and again, by their acts and omissions, that they can't be trusted. Relevant quote from the source: "During testing this with an off the shelf infostealer, I used Microsoft Defender for Endpoint — which detected the off the shelve infostealer — but by the time the automated remediation kicked in (which took over ten minutes) my Recall data was already long gone [ie. exfiltrated to a bad actor's device]."
• jolj 2y ago
  There are some things that a small startup like Rewind can do, that a large company like Microsoft can never get away with. It's more in the feelings space than rational space, just like privacy in general
• j-bos 2y ago
  Perhaps you have lived a charmed life. Stable government, never gotten on the nerves of power brokers, no former friends with abusive tendencies, never been a refugee of state actions. And you, nor those you care about, do not expect to be on the receiving end of any of that. Then having less and less privacy is fine. And it's perfectly reasonable to trust Microsoft to implement this tool with honesty and care.
  • wilsonnb3 2y ago
    I do live a charmed life by those standards but my point is that it isn't a privacy issue at all to me. Storage and processing happens on your device and it is encrypted, so I don't see how this feature makes my information less private at all. It seems like the actual issue people have is that they don't trust Microsoft or they don't trust the government/people/everyone. Which is fine and understandable, it just isn't related to privacy.
    • shuntress 2y ago
      > Storage and processing happens on your device and it is encrypted Microsoft controls this entire process. They could easily send copies back to "the mothership" like they probably already do with the processed results. > It seems like the actual issue people have is that they don't trust Microsoft or they don't trust the government/people/everyone. Whether or not this invasion of privacy is cause for concern depends on your level of trust. But it is still a privacy issue.
      • wilsonnb3 2y ago
        > Microsoft controls this entire process. They could easily send copies back to "the mothership" like they probably already do with the processed results Microsoft controls the whole operating system, they can already do whatever they want with your data. They could be sending screenshots back to the mother ship already. I can understand why people may not trust them but they already have the keys to the kingdom. This new feature isn't any more or less private than Windows already is.
    • 2y ago
• cesarb 2y ago
  > I don't understand why people have such a big privacy issue with this. It all happens on your device. For now. It's not hard to predict that, sooner or later, Microsoft will want to send that information to be processed somewhere in the cloud (and of course, they will say that it's encrypted in transit, and will never be shared with anyone else...) There's also a more fundamental issue: absent explicit recording, we treat everything that's output to the screen and speakers as ephemeral. Recording everything by default changes that paradigm. It's like having a hidden camera permanently recording on your bedroom: it's a place where we expect privacy. > You shouldn't expect privacy on public or work computers. For all you know, they could already be doing this. They could, but they shouldn't. It's like a hotel room: for all we know, it could have a hidden camera permanently recording everything that happens in it, but we still consider it a serious privacy violation when that actually happens. > And if your laptop is stolen and they have your passwords, you're fucked anyways. My laptop being stolen doesn't currently mean that the thief can know exactly what my screen was showing a couple of weeks ago.
  • wilsonnb3 2y ago
    You bring up a good point about making previously ephemeral activities recorded, I can see why people would take issue with that.
  • concinds 2y ago
    > It's not hard to predict that, sooner or later, Microsoft will want to send that information to be processed somewhere in the cloud I really don't believe that. It reminds me of the hysteria about Windows 10 telemetry (remember when people called it a keylogger?). Putting it in the cloud would cause huge backlash and brand damage. But somehow they're getting that backlash despite not putting it in the cloud. > absent explicit recording, we treat everything that's output to the screen and speakers as ephemeral Computer forensics experts would like a word. Your past activity has never been private from "yourself". The added privacy risk here is highly marginal. If I steal someone's laptop, I can Rewind and see what was in a PowerPoint slide they opened 2 weeks ago. But that PowerPoint is almost certainly still on the local drive anyway, so that makes no difference.
• k8svet 2y ago
  If I trusted Windows's security. If I trusted (the competency or integrity of) Microsoft developers. If I trusted this to not get swept up in telemetry, or accidentally left in some never-to-be-cleaned tempdir. If I trusted Microsoft to be able to develop Windows features that were actually entirely disable-able or removable. If all those things were true, then meh, fine. But for me, none of them are true, and it makes me truly happy to already be a happy Linux user.
• phito 2y ago
  It's easy, I don't trust them. They can promise that it's local all they want, I don't trust them.
• gopher_space 2y ago
  “there are so many attack vectors, what’s several more?” I wish we could fork windows 10 and put whoever’s working on vscode and half of OneNote in charge of it.
• alkonaut 2y ago
  > you shouldn't expect privacy on public or work computers. For all you know, they could already be doing this. It might be something I should expect, but I'd still slap my laptop over the head of my superiors if I found out that there was scren recording on employee computers. Regardless of whether it's legal, and regardless of whether I signed a form saying I understood that this was within their right. Any manager or corporate IT person who doesn't understand that actually implementing that would mean severe risk of being slapped in the head with laptops is clincally insane. I agree there shouldn't be much privacy outrage for this particular windows feature so long as this is a local-only feature and I can disable it.
• JohnFen 2y ago
  > It all happens on your device. I am not at all confident that this is true. If we take Microsoft at their word, the raw data is stored on your device. But is processing ever done on Microsoft servers? Are the results of that processing ever sent to Microsoft servers? Given that Microsoft is pretty aggressive about moving Windows to being an OS-as-a-service, it's hard for me to think that all the data Windows handles stays on-device.
• logrot 2y ago
  If you get hacked, the hacker has a video record of the last 3 months of your life. Passwords included. Surely that can't be hard to understand?