5 ms·

Its keys or the token which gets the key from the TPM will probably be memory resident. I don't see encryption as a barrier to get relevant information. In the

Its keys or the token which gets the key from the TPM will probably be memory resident. I don't see encryption as a barrier to get relevant information. In the future, if I know Microsoft, this trove will be mined for "consumer oriented optimization and improvement of Windows Experience". This means at least a DLL or more probably an API will be present to tap into that data, which can be (ab)used by third parties. So, even if it's stored locally and be encrypted at rest, it doesn't mean it'll be completely unavailable to Microsoft or third parties. Oh, lastly, I'm sure that there'll be at least one forensics company which will build a tool to dump this data, making governments do a little happy dance.

dgellow 2y ago
We will see. I still have some hopes, call me foolish or naive, that Microsoft will implement Recall in way that would be compliant with EU GDPR. The user is in control and can decide how data are being accessed. So far that’s what I’ve seen, users can control applications, website that are saved, and for how long. They can also easily delete a timeframe of data. But if I’m honest I would never use that feature if I would leave outside of the EU, I don’t know another regulatory body big tech is taking seriously.
- Aerroon 2y ago
  Even if the user is in control the machine can still be compromised. And since that data is available the data can be stolen.
  - dgellow 2y ago
    Sure, but that’s like saying your browser history + cookies + local storage + ssh keys + Auth tokens + … could be stolen on a compromised machine because it’s valuable data. It’s true but not something against the feature itself
    - Aerroon 2y ago
      Yeah, but this massively expands on what data becomes vulnerable.
- bayindirh 2y ago
  > They can also easily delete a timeframe of data. Does the system really delete it, or mark it as deleted? I'm not so sure. > I would never use that feature if I would leave outside of the EU Considering the EU's love of "lawful interception", I'd never use that feature even if I live in EU. > I don’t know another regulatory body big tech is taking seriously. Yet, everybody is trying to circumvent GPDR somehow (because monies).
  - dgellow 2y ago
    There is nothing to intercept, it’s local storage Companies are regularly fined meaningful amounts due to not respecting Gdpr, citizens have clear ways to complain, companies do take EU rules seriously given risks of massive fines. I’m pretty sure it’s the most successful, well known privacy regulatory framework in the world, to the point where other regions point to it to describe their own frameworks.
    - bayindirh 2y ago
      Lawful interception is not limited to network capture and traffic sniffing. Border searches and “enhancement of the target device with surveillance tools to increase visibility” (i.e.: bugging your device with surveillance software) is also lawful interception. I live in a country which borders EU. We have GPDR compatible laws and my work contains a lot of cooperation with people and organizations inside EU. However, I think you can still find some “legitimate interest” in that data to mine it nevertheless.
      - dgellow 2y ago
        Good point, thanks for pointing that out

dgellow 2y ago

We will see. I still have some hopes, call me foolish or naive, that Microsoft will implement Recall in way that would be compliant with EU GDPR. The user is in control and can decide how data are being accessed. So far that’s what I’ve seen, users can control applications, website that are saved, and for how long. They can also easily delete a timeframe of data. But if I’m honest I would never use that feature if I would leave outside of the EU, I don’t know another regulatory body big tech is taking seriously.

Aerroon 2y ago
Even if the user is in control the machine can still be compromised. And since that data is available the data can be stolen.
- dgellow 2y ago
  Sure, but that’s like saying your browser history + cookies + local storage + ssh keys + Auth tokens + … could be stolen on a compromised machine because it’s valuable data. It’s true but not something against the feature itself
  - Aerroon 2y ago
    Yeah, but this massively expands on what data becomes vulnerable.
bayindirh 2y ago
> They can also easily delete a timeframe of data. Does the system really delete it, or mark it as deleted? I'm not so sure. > I would never use that feature if I would leave outside of the EU Considering the EU's love of "lawful interception", I'd never use that feature even if I live in EU. > I don’t know another regulatory body big tech is taking seriously. Yet, everybody is trying to circumvent GPDR somehow (because monies).
- dgellow 2y ago
  There is nothing to intercept, it’s local storage Companies are regularly fined meaningful amounts due to not respecting Gdpr, citizens have clear ways to complain, companies do take EU rules seriously given risks of massive fines. I’m pretty sure it’s the most successful, well known privacy regulatory framework in the world, to the point where other regions point to it to describe their own frameworks.
  - bayindirh 2y ago
    Lawful interception is not limited to network capture and traffic sniffing. Border searches and “enhancement of the target device with surveillance tools to increase visibility” (i.e.: bugging your device with surveillance software) is also lawful interception. I live in a country which borders EU. We have GPDR compatible laws and my work contains a lot of cooperation with people and organizations inside EU. However, I think you can still find some “legitimate interest” in that data to mine it nevertheless.
    - dgellow 2y ago
      Good point, thanks for pointing that out