5 ms·
The even more worrying thing for anyone considering any solutions which do such mass surveillance, regardless of motive (like Windows Rewind). They're all one o
by buran77 2y ago
The even more worrying thing for anyone considering any solutions which do such mass surveillance, regardless of motive (like Windows Rewind). They're all one or two steps removed from massive scale access to these recordings. All of the steps have happened repeatedly in the past. The only way to be safer is not keep that data in the first place.
> the tiny shell lets anyone execute abitrary php code by simply setting a cookie. what makes this file such an interesting find, though, is that the shell has been present since at least december 2011 (which is when the site got moved to its current server). it is impossible to tell whether this shell was placed there by pcTattletale (for whatever reason) or by a threat actor; either way, it reveals that pcTattletale has been backdoored for basically forever and may have had data exfiltrated from it for years by external actors
- dgellow 2y agoWindows Recall is stored locally and encrypted from what I understood
- dorkwood 2y agoYes. I've heard it's unhackable. We are in good hands.
- WhackyIdeas 2y agoFor anyone downvoting this person, keep in mind they are quite obviously being sarcastic……
- buran77 2y agoUntil a year or two later when MS rolls out the feature of "AI" on "your data". Or gives the option/default to store the recording on OneDrive. Or any number of options that MS can monetize somehow while selling it as a benefit for you. How many massively popular feature requests sit on the waiting list every day while this one comes out of the blue despite almost no user ever asking for it, and it's for you? Rewind is the house's foundation, the rest of the walls come later. How fast they come depends on what the CEO sees as the future of making money. Having these recordings is a liability more than it is a productivity boost. People today don't operate computers under the assumption they are recorded at all times even if they know the feature is there. So of course it's dangerous. One day, when you'll be thoroughly used to being surveilled at all times, having Rewind-like features will be as ubiquitous or as normal as walking around today with a GPS tracker, microphone and spy cam in your pocket, for someone else to use. Something equally unacceptable some decades ago.
- wkat4242 2y ago> Until a year or two later when MS rolls out the feature of "AI" on "your data" It's already touted as an AI feature. And yes Microsoft is very adamant the images are stored locally, I wonder if all the processing is purely local too though.
- buran77 2y ago> Microsoft is very adamant the images are stored locally But this is today (as in "at the literal moment the statement was made"). What about tomorrow? History is plastered with examples of things companies were adamant about and as it turned out they either didn't keep their word for long or even it was a lie as it was spoken. One day they'll decide it's for your own interest to share this data. Or a patch will accidentally sync it to the cloud. Or their model will be trained on your data. Or authorities start targeting this for obtaining way more data than otherwise needed. Or malware will use it as a treasure trove of info like never before. All of this keeps happening, I can't bring myself to believe this case in particular will break the mold.
- wkat4242 2y agoYes I don't trust them either. At all. I didn't say that too explicitly, sorry.
- rgmerk 2y agoDoesn't matter as a tool of domestic abuse, as the attacker almost certainly has local access to the device concerned. The howls of outrage when Microsoft announced this are such that they may well have gotten the message on this one. But somebody else lower-profile will have the same bright idea.
- wkat4242 2y agoTrue, an attacker can install a screen capture tool but they will not automatically have the access to data from months back of course.
- squigz 2y agoUntil Microsoft wants to start using that data, or is compelled to hand it over.
- jocoda 2y agoI'm all for tools like this if they allow me to review my activity, especially if that's across the multiple systems I use, to get a handle on how and where I spend my time. It's not a surprise that Microsoft and Apple are determined to get us to use their cloud products for our personal data - there's billions up for grab.
- bayindirh 2y agoIts keys or the token which gets the key from the TPM will probably be memory resident. I don't see encryption as a barrier to get relevant information. In the future, if I know Microsoft, this trove will be mined for "consumer oriented optimization and improvement of Windows Experience". This means at least a DLL or more probably an API will be present to tap into that data, which can be (ab)used by third parties. So, even if it's stored locally and be encrypted at rest, it doesn't mean it'll be completely unavailable to Microsoft or third parties. Oh, lastly, I'm sure that there'll be at least one forensics company which will build a tool to dump this data, making governments do a little happy dance.
- dgellow 2y agoWe will see. I still have some hopes, call me foolish or naive, that Microsoft will implement Recall in way that would be compliant with EU GDPR. The user is in control and can decide how data are being accessed. So far that’s what I’ve seen, users can control applications, website that are saved, and for how long. They can also easily delete a timeframe of data. But if I’m honest I would never use that feature if I would leave outside of the EU, I don’t know another regulatory body big tech is taking seriously.
- Aerroon 2y agoEven if the user is in control the machine can still be compromised. And since that data is available the data can be stolen.
- dgellow 2y agoSure, but that’s like saying your browser history + cookies + local storage + ssh keys + Auth tokens + … could be stolen on a compromised machine because it’s valuable data. It’s true but not something against the feature itself
- Aerroon 2y agoYeah, but this massively expands on what data becomes vulnerable.
- a0123 2y agoThat's fine then because no one has ever managed to get around a single security measure, especially not in the world of computing.
- zxxh 2y ago[dead]
- TiredOfLife 2y agoAlso newer ever make any notes or take any photos/video of anything. Talk only face to face in a cone of silence.
- buran77 2y agoThe sarcasm made an already shaky point even worse. There's a huge difference in magnitude here (writing a note vs. screen grabbing everything you ever do on the computer), and also a difference of awareness (intently recording one moment in time with a photo vs. almost unconsciously being recorded all the time even if you enabled it). These simplistic fallacies are the result of very superficial assessments. Either an apparently small mistake leads to a wildly wrong conclusion (being overheard once is the same as being overheard all the time, because overheard is overheard), or everything is justifiable in small increments so you just loop through them as many times as it takes to get to a wildly unacceptable result (if one photo is ok, then two photos are ok, and just iterate it until you get 30 photos per second of constant video surveillance, you just said you're fine with one more photo). Bottom line being you won't get anything of value out of such a conversation. I know I don't.
- VS1999 2y agoThis dismissive, snarky one-liner only works if people already overwhelmingly agree with you. Most people are tired of companies adding more and more surveillance "features" and grew up in a time that set a higher bar for how much privacy they're willing to give away. A user taking a note? Sure. The OS recording everything you do 24/7 to send through an AI? Maybe we need new legislation to address your behavior.
- Renaud 2y agoIsn't MS Rewind/Recall supposed to be encrypted and offline, on-device only? I don't see how it could be anything else and pass any data-protection regulation (in the EU, at least). It's a hazard and its usefulness needs to be balanced with other needs, but on a work machine that belongs to me, it could be useful. Now, if my boss has unfettered access to this data, or any of it is online, then obviously it's a no no. Understanding the implications of tools like this is necessary. I'm not too optimistic that the general user will fully understand these implications though. That's one of the main danger with these technologies: promises are made, people don't think twice and overshare, and the data is used against their interests. However, I want it to exist, MS or Open Source, preferrably, but only if I get 100% control over it, and it is never accessible to anyone else. Having said that, I'm very much aware that most implementation of these tools will become a security and surveillance nightmare. The next few years are going to be interesting, and probably frightening.
- sandworm101 2y ago>> Isn't MS Rewind/Recall supposed to be encrypted and offline, on-device only? From what I have been reading, the raw data is meant to remain local (the screen recordings) but I am unclear about the indexed AI-generated metadata. For instance, if the AI identified that you used X software at Y time to complete Z task, are the XYZ tags kept local or archived elsewhere? That might not violate many privacy rules. Either way, they certainly could be uploaded/shared very easily should Microsoft's policies change. I guess it is down to how much we all trust Microsoft long term. Personally, I will never accept someone recording my screens. In fact, running any such software on my work machine would violate a host of professional rules.
- jkaplowitz 2y agoI can’t imagine them not providing a way to turn Recall off, for reasons like the ones you describe.
- sandworm101 2y agoOh I'm very sure there will be a box to untick, which we will all have to dutifully check after every tiny software update.