5 ms·

Windows Recall is stored locally and encrypted from what I understood

by dgellow 2y ago

dorkwood 2y ago
Yes. I've heard it's unhackable. We are in good hands.
- WhackyIdeas 2y ago
  For anyone downvoting this person, keep in mind they are quite obviously being sarcastic……
buran77 2y ago
Until a year or two later when MS rolls out the feature of "AI" on "your data". Or gives the option/default to store the recording on OneDrive. Or any number of options that MS can monetize somehow while selling it as a benefit for you. How many massively popular feature requests sit on the waiting list every day while this one comes out of the blue despite almost no user ever asking for it, and it's for you? Rewind is the house's foundation, the rest of the walls come later. How fast they come depends on what the CEO sees as the future of making money. Having these recordings is a liability more than it is a productivity boost. People today don't operate computers under the assumption they are recorded at all times even if they know the feature is there. So of course it's dangerous. One day, when you'll be thoroughly used to being surveilled at all times, having Rewind-like features will be as ubiquitous or as normal as walking around today with a GPS tracker, microphone and spy cam in your pocket, for someone else to use. Something equally unacceptable some decades ago.
- wkat4242 2y ago
  > Until a year or two later when MS rolls out the feature of "AI" on "your data" It's already touted as an AI feature. And yes Microsoft is very adamant the images are stored locally, I wonder if all the processing is purely local too though.
  - buran77 2y ago
    > Microsoft is very adamant the images are stored locally But this is today (as in "at the literal moment the statement was made"). What about tomorrow? History is plastered with examples of things companies were adamant about and as it turned out they either didn't keep their word for long or even it was a lie as it was spoken. One day they'll decide it's for your own interest to share this data. Or a patch will accidentally sync it to the cloud. Or their model will be trained on your data. Or authorities start targeting this for obtaining way more data than otherwise needed. Or malware will use it as a treasure trove of info like never before. All of this keeps happening, I can't bring myself to believe this case in particular will break the mold.
    - wkat4242 2y ago
      Yes I don't trust them either. At all. I didn't say that too explicitly, sorry.
  - rgmerk 2y ago
    Doesn't matter as a tool of domestic abuse, as the attacker almost certainly has local access to the device concerned. The howls of outrage when Microsoft announced this are such that they may well have gotten the message on this one. But somebody else lower-profile will have the same bright idea.
    - wkat4242 2y ago
      True, an attacker can install a screen capture tool but they will not automatically have the access to data from months back of course.
      - rgmerk 2y ago
        True. And domestic abusers do install such tools, by the way.
- dgellow 2y ago
  > despite almost no user ever asking for it Honestly I never asked for it but now that I’ve seen it I want to try on my personal machines, if data are local I have no issues with it at all. I’m personally not afraid of Microsoft, but I understand they haven’t been good at building trust for the past decade+. It would be awesome as an open source project. However I can see how something like Recall is pretty problematic in a corporate context, when enabled by admins without end-user controls
  - a0123 2y ago
    The tech demos never work as demonstrated at the tech demo conference.
    - dgellow 2y ago
      That’s why I want to try on my personal machines, to see how useful that is
- WhackyIdeas 2y ago
  The only good thing about Recall is that it has been the definitive decider of moving away from Microsoft permanently because for them to create such a ‘feature’ shows a complete lack of care about people’s private data - they’ll be leaving a huge jackpot prize for anyone who breaks into a system. Just the kind of thing this NSA Prism-participating company would think was a top notch idea. Not saying the real motive is surveillance… I’m sure a feature update or two away will also turn the data into a real money maker of advertising which instead of just being able to advertise to you, can kill two birds with one stone in being able to increase tenfold the ad revenue by watching who you’re talking with in your emails, your PM’s on Facebook (or wherever else) and then selling marketing data on you AND them. If I was a purely profit driven individual - I’d be doing exactly that. But I have too much of a heart. Even if they say that they’ll be abandoning this idea as they have ‘listened to user feedback’ or some other bull, the complete damage has already been done here. Thank the lord there are an abundance of excellent OS alternatives.
  - mistrial9 2y ago
    no - the employer makes their subjects do it. It has always been that way, now it is more obvious, again.
- sandworm101 2y ago
  >> One day, when you'll be thoroughly used to being surveilled at all times When that day comes, when you don't want someone recording your screen and rummaging around your hard drives, linux will be there. Every bad day for Windows is a good day for linux.
squigz 2y ago
Until Microsoft wants to start using that data, or is compelled to hand it over.
jocoda 2y ago
I'm all for tools like this if they allow me to review my activity, especially if that's across the multiple systems I use, to get a handle on how and where I spend my time. It's not a surprise that Microsoft and Apple are determined to get us to use their cloud products for our personal data - there's billions up for grab.
bayindirh 2y ago
Its keys or the token which gets the key from the TPM will probably be memory resident. I don't see encryption as a barrier to get relevant information. In the future, if I know Microsoft, this trove will be mined for "consumer oriented optimization and improvement of Windows Experience". This means at least a DLL or more probably an API will be present to tap into that data, which can be (ab)used by third parties. So, even if it's stored locally and be encrypted at rest, it doesn't mean it'll be completely unavailable to Microsoft or third parties. Oh, lastly, I'm sure that there'll be at least one forensics company which will build a tool to dump this data, making governments do a little happy dance.
- dgellow 2y ago
  We will see. I still have some hopes, call me foolish or naive, that Microsoft will implement Recall in way that would be compliant with EU GDPR. The user is in control and can decide how data are being accessed. So far that’s what I’ve seen, users can control applications, website that are saved, and for how long. They can also easily delete a timeframe of data. But if I’m honest I would never use that feature if I would leave outside of the EU, I don’t know another regulatory body big tech is taking seriously.
  - Aerroon 2y ago
    Even if the user is in control the machine can still be compromised. And since that data is available the data can be stolen.
    - dgellow 2y ago
      Sure, but that’s like saying your browser history + cookies + local storage + ssh keys + Auth tokens + … could be stolen on a compromised machine because it’s valuable data. It’s true but not something against the feature itself
      - Aerroon 2y ago
        Yeah, but this massively expands on what data becomes vulnerable.
a0123 2y ago
That's fine then because no one has ever managed to get around a single security measure, especially not in the world of computing.

Windows Recall is stored locally and encrypted from what I understood

dorkwood 2y ago

Yes. I've heard it's unhackable. We are in good hands.

WhackyIdeas 2y ago
For anyone downvoting this person, keep in mind they are quite obviously being sarcastic……

buran77 2y ago

Until a year or two later when MS rolls out the feature of "AI" on "your data". Or gives the option/default to store the recording on OneDrive. Or any number of options that MS can monetize somehow while selling it as a benefit for you. How many massively popular feature requests sit on the waiting list every day while this one comes out of the blue despite almost no user ever asking for it, and it's for you? Rewind is the house's foundation, the rest of the walls come later. How fast they come depends on what the CEO sees as the future of making money. Having these recordings is a liability more than it is a productivity boost. People today don't operate computers under the assumption they are recorded at all times even if they know the feature is there. So of course it's dangerous. One day, when you'll be thoroughly used to being surveilled at all times, having Rewind-like features will be as ubiquitous or as normal as walking around today with a GPS tracker, microphone and spy cam in your pocket, for someone else to use. Something equally unacceptable some decades ago.

wkat4242 2y ago
> Until a year or two later when MS rolls out the feature of "AI" on "your data" It's already touted as an AI feature. And yes Microsoft is very adamant the images are stored locally, I wonder if all the processing is purely local too though.
- buran77 2y ago
  > Microsoft is very adamant the images are stored locally But this is today (as in "at the literal moment the statement was made"). What about tomorrow? History is plastered with examples of things companies were adamant about and as it turned out they either didn't keep their word for long or even it was a lie as it was spoken. One day they'll decide it's for your own interest to share this data. Or a patch will accidentally sync it to the cloud. Or their model will be trained on your data. Or authorities start targeting this for obtaining way more data than otherwise needed. Or malware will use it as a treasure trove of info like never before. All of this keeps happening, I can't bring myself to believe this case in particular will break the mold.
  - wkat4242 2y ago
    Yes I don't trust them either. At all. I didn't say that too explicitly, sorry.
- rgmerk 2y ago
  Doesn't matter as a tool of domestic abuse, as the attacker almost certainly has local access to the device concerned. The howls of outrage when Microsoft announced this are such that they may well have gotten the message on this one. But somebody else lower-profile will have the same bright idea.
  - wkat4242 2y ago
    True, an attacker can install a screen capture tool but they will not automatically have the access to data from months back of course.
    - rgmerk 2y ago
      True. And domestic abusers do install such tools, by the way.
dgellow 2y ago
> despite almost no user ever asking for it Honestly I never asked for it but now that I’ve seen it I want to try on my personal machines, if data are local I have no issues with it at all. I’m personally not afraid of Microsoft, but I understand they haven’t been good at building trust for the past decade+. It would be awesome as an open source project. However I can see how something like Recall is pretty problematic in a corporate context, when enabled by admins without end-user controls
- a0123 2y ago
  The tech demos never work as demonstrated at the tech demo conference.
  - dgellow 2y ago
    That’s why I want to try on my personal machines, to see how useful that is
WhackyIdeas 2y ago
The only good thing about Recall is that it has been the definitive decider of moving away from Microsoft permanently because for them to create such a ‘feature’ shows a complete lack of care about people’s private data - they’ll be leaving a huge jackpot prize for anyone who breaks into a system. Just the kind of thing this NSA Prism-participating company would think was a top notch idea. Not saying the real motive is surveillance… I’m sure a feature update or two away will also turn the data into a real money maker of advertising which instead of just being able to advertise to you, can kill two birds with one stone in being able to increase tenfold the ad revenue by watching who you’re talking with in your emails, your PM’s on Facebook (or wherever else) and then selling marketing data on you AND them. If I was a purely profit driven individual - I’d be doing exactly that. But I have too much of a heart. Even if they say that they’ll be abandoning this idea as they have ‘listened to user feedback’ or some other bull, the complete damage has already been done here. Thank the lord there are an abundance of excellent OS alternatives.
- mistrial9 2y ago
  no - the employer makes their subjects do it. It has always been that way, now it is more obvious, again.
sandworm101 2y ago
>> One day, when you'll be thoroughly used to being surveilled at all times When that day comes, when you don't want someone recording your screen and rummaging around your hard drives, linux will be there. Every bad day for Windows is a good day for linux.

squigz 2y ago

Until Microsoft wants to start using that data, or is compelled to hand it over.

jocoda 2y ago

I'm all for tools like this if they allow me to review my activity, especially if that's across the multiple systems I use, to get a handle on how and where I spend my time. It's not a surprise that Microsoft and Apple are determined to get us to use their cloud products for our personal data - there's billions up for grab.

bayindirh 2y ago

Its keys or the token which gets the key from the TPM will probably be memory resident. I don't see encryption as a barrier to get relevant information. In the future, if I know Microsoft, this trove will be mined for "consumer oriented optimization and improvement of Windows Experience". This means at least a DLL or more probably an API will be present to tap into that data, which can be (ab)used by third parties. So, even if it's stored locally and be encrypted at rest, it doesn't mean it'll be completely unavailable to Microsoft or third parties. Oh, lastly, I'm sure that there'll be at least one forensics company which will build a tool to dump this data, making governments do a little happy dance.

dgellow 2y ago
We will see. I still have some hopes, call me foolish or naive, that Microsoft will implement Recall in way that would be compliant with EU GDPR. The user is in control and can decide how data are being accessed. So far that’s what I’ve seen, users can control applications, website that are saved, and for how long. They can also easily delete a timeframe of data. But if I’m honest I would never use that feature if I would leave outside of the EU, I don’t know another regulatory body big tech is taking seriously.
- Aerroon 2y ago
  Even if the user is in control the machine can still be compromised. And since that data is available the data can be stolen.
  - dgellow 2y ago
    Sure, but that’s like saying your browser history + cookies + local storage + ssh keys + Auth tokens + … could be stolen on a compromised machine because it’s valuable data. It’s true but not something against the feature itself
    - Aerroon 2y ago
      Yeah, but this massively expands on what data becomes vulnerable.

a0123 2y ago

That's fine then because no one has ever managed to get around a single security measure, especially not in the world of computing.