4 ms·

Pwned in what way? This is just a SQLite database, you can "pwn" it with any SQLite client of your choice.

by gigel82 2y ago

JohnFen 2y ago
Weren't were told it was encrypted and that this sort of access wouldn't be possible?
- Dylan16807 2y ago
  Can you quote anything? I don't remember microsoft saying you couldn't access your own data. The fact that a different user can get to it so easily is bad though. And the FAQ claims that remote access is possible but does not elaborate, so that's confusing.
  - lolinder 2y ago
    The point is that the existence of this code proves that remote access is possible, you just use any one of the many proven malware vectors to get the user to install a binary that does the same thing as this repo does but ships it over the network to your servers.
    - Dylan16807 2y ago
      That seems like an unreasonably broad definition of remote access to me. If installing a local program that proxies data counts, then the only true way to make "remote access" impossible is by installing it in a secure room with no networking and where no other electronics are allowed in. How many people interpreted that claim as SCIF-equivalency?
      - lolinder 2y ago
        > How many people interpreted that claim as SCIF-equivalency? Basically everyone who isn't employed in tech? This is what the BBC said [0]: > And it said a would-be hacker would need to gain physical access to your device, unlock it and sign in before they could access saved screenshots. Those of us here can readily see that this "physical access" claim is bunk, but that's what Microsoft represented to the BBC and what the BBC is telling the world. [0] https://www.bbc.com/news/articles/cpwwqp6nx14o https://www.bbc.com/news/articles/cpwwqp6nx14o
        Dylan16807 2y ago
        If it's just to prove those two words wrong, then this repo seems extremely overblown. "It works like every other program in the world" isn't very exploity. Also I don't think many people even saw or noticed that particular claim. They just saw the part about it saving everything you do to your computer and were rightfully worried.
        pseudalopex 2y ago
        > If it's just to prove those two words wrong, then this repo seems extremely overblown. "It works like every other program in the world" isn't very exploity. The FAQ author explained it worked like every other program in the world. Some people doubted him because why wouldn't he show proof if it was so easy? The tool author called it a very simple tool and no rocket science whatsoever. > Also I don't think many people even saw or noticed that particular claim. Fewer people will see this repo. What is the correct number of people before misinformation should be corrected?
        Dylan16807 2y ago
        > The FAQ author explained it worked like every other program in the world. Some people doubted him because why wouldn't he show proof if it was so easy? The tool author called it a very simple tool and no rocket science whatsoever. The repo overall makes it sound like it's a way bigger issue than that.
        pseudalopex 2y ago
        > The repo overall makes it sound like it's a way bigger issue than that. The repo overall contains a tool the author said 3x was simple or not rocket science, an explanation of what the tool does, and someone else's FAQ about the context.
        Dylan16807 2y ago
        It comes across as a rebuttal to any and all claims of security, not just the phrase "physical access".
  - wvenable 2y ago
    A different user could also get your browser cache, your cookies, and install all sorts of horrible programs running as Admin as well. This isn't really different.
  - JohnFen 2y ago
    > The fact that a different user can get to it so easily is bad though. This is what I was referring to. The data this collects is of high sensitivity and value. It will, without question, be targeted aggressively. It needs to be handled accordingly. While I think that this service is dangerous and misguided and shouldn't be used by most people, I would hope that Microsoft would at least be a whole lot more careful about protecting those who do. About being encrypted, here are quotes from Microsoft docs (https://support.microsoft.com/en-au/windows/privacy-and-control-over-your-recall-experience-d404f672-7647-41e5-886c-a3c59680af15 https://support.microsoft.com/en-au/windows/privacy-and-cont...): > Recall processes your content locally on the Copilot+ PC and securely stores it on your device While it doesn't use the word "encrypted" here, "stores securely" certainly implies that. > Snapshots are encrypted by Device Encryption or BitLocker, which are enabled by default on Windows 11. Here is where they say encrypted. They also say it's just from BitLocker, which means it's not really encrypted in the sense that security-minded people would assume (encrypted separately from the whole-disk encryption). I also think most laypeople won't really understand what this means.
- hypeatei 2y ago
  Encryption is not authentication.

Pwned in what way? This is just a SQLite database, you can "pwn" it with any SQLite client of your choice.

JohnFen 2y ago

Weren't were told it was encrypted and that this sort of access wouldn't be possible?

Dylan16807 2y ago
Can you quote anything? I don't remember microsoft saying you couldn't access your own data. The fact that a different user can get to it so easily is bad though. And the FAQ claims that remote access is possible but does not elaborate, so that's confusing.
- lolinder 2y ago
  The point is that the existence of this code proves that remote access is possible, you just use any one of the many proven malware vectors to get the user to install a binary that does the same thing as this repo does but ships it over the network to your servers.
  - Dylan16807 2y ago
    That seems like an unreasonably broad definition of remote access to me. If installing a local program that proxies data counts, then the only true way to make "remote access" impossible is by installing it in a secure room with no networking and where no other electronics are allowed in. How many people interpreted that claim as SCIF-equivalency?
    - lolinder 2y ago
      > How many people interpreted that claim as SCIF-equivalency? Basically everyone who isn't employed in tech? This is what the BBC said [0]: > And it said a would-be hacker would need to gain physical access to your device, unlock it and sign in before they could access saved screenshots. Those of us here can readily see that this "physical access" claim is bunk, but that's what Microsoft represented to the BBC and what the BBC is telling the world. [0] https://www.bbc.com/news/articles/cpwwqp6nx14o https://www.bbc.com/news/articles/cpwwqp6nx14o
      - Dylan16807 2y ago
        If it's just to prove those two words wrong, then this repo seems extremely overblown. "It works like every other program in the world" isn't very exploity. Also I don't think many people even saw or noticed that particular claim. They just saw the part about it saving everything you do to your computer and were rightfully worried.
        pseudalopex 2y ago
        > If it's just to prove those two words wrong, then this repo seems extremely overblown. "It works like every other program in the world" isn't very exploity. The FAQ author explained it worked like every other program in the world. Some people doubted him because why wouldn't he show proof if it was so easy? The tool author called it a very simple tool and no rocket science whatsoever. > Also I don't think many people even saw or noticed that particular claim. Fewer people will see this repo. What is the correct number of people before misinformation should be corrected?
        Dylan16807 2y ago
        > The FAQ author explained it worked like every other program in the world. Some people doubted him because why wouldn't he show proof if it was so easy? The tool author called it a very simple tool and no rocket science whatsoever. The repo overall makes it sound like it's a way bigger issue than that.
        pseudalopex 2y ago
        > The repo overall makes it sound like it's a way bigger issue than that. The repo overall contains a tool the author said 3x was simple or not rocket science, an explanation of what the tool does, and someone else's FAQ about the context.
        Dylan16807 2y ago
        It comes across as a rebuttal to any and all claims of security, not just the phrase "physical access".
- wvenable 2y ago
  A different user could also get your browser cache, your cookies, and install all sorts of horrible programs running as Admin as well. This isn't really different.
- JohnFen 2y ago
  > The fact that a different user can get to it so easily is bad though. This is what I was referring to. The data this collects is of high sensitivity and value. It will, without question, be targeted aggressively. It needs to be handled accordingly. While I think that this service is dangerous and misguided and shouldn't be used by most people, I would hope that Microsoft would at least be a whole lot more careful about protecting those who do. About being encrypted, here are quotes from Microsoft docs (https://support.microsoft.com/en-au/windows/privacy-and-control-over-your-recall-experience-d404f672-7647-41e5-886c-a3c59680af15 https://support.microsoft.com/en-au/windows/privacy-and-cont...): > Recall processes your content locally on the Copilot+ PC and securely stores it on your device While it doesn't use the word "encrypted" here, "stores securely" certainly implies that. > Snapshots are encrypted by Device Encryption or BitLocker, which are enabled by default on Windows 11. Here is where they say encrypted. They also say it's just from BitLocker, which means it's not really encrypted in the sense that security-minded people would assume (encrypted separately from the whole-disk encryption). I also think most laypeople won't really understand what this means.
hypeatei 2y ago
Encryption is not authentication.