4 ms·

The repo is along the lines of "2+2=4". GP said there is nothing interesting in that, to which I pointed to the QnA entry which shows that MS did tell a journal

The repo is along the lines of "2+2=4". GP said there is nothing interesting in that, to which I pointed to the QnA entry which shows that MS did tell a journalist that "2+2=22", so to speak. What else is there to disprove? The significance of the repo is not to show 2+2=4 but that 2+2 != 22

Dylan16807 2y ago
The BBC quote says "a would-be hacker". I interpreted that as a general claim about windows security, not saying that this particular feature is invisible to malware. They have to break the security of your particular device, the data is nowhere else.
- smarx007 2y ago
  > I interpreted that as a general claim about windows security Sure, because you understand that the other interpretation is nonsensical. All the publications that are popping up showing that the Recall DB is locally accessible are aimed at all the other Windows users. Now, I would fully agree if you question what's the benefit of posting this on GH and not on FB, for example, and what's in there to surprise the HN crowd.
  - Dylan16807 2y ago
    > All the publications that are popping up showing that the Recall DB is locally accessible are aimed at all the other Windows users. See, that's the thing. Proving it's locally accessible... Microsoft never even implied it wasn't locally accessible.
    - pseudalopex 2y ago
      > Microsoft never even implied it wasn't locally accessible. BBC said Microsoft said a hacker would need physical access. You can think this meant to hack Recall or Windows.
      - Dylan16807 2y ago
        Right. They specifically laid out a scenario where the data is locally accessible. So code that proves the data is locally accessible doesn't contradict them.
        pseudalopex 2y ago
        https://news.ycombinator.com/item?id=40579531 https://news.ycombinator.com/item?id=40579531
        Dylan16807 2y ago
        ? That comment thread is about a completely different thing at this point.
        pseudalopex 2y ago
        I assumed your meaning of local was consistent across comments. Was it not?
  - pseudalopex 2y ago
    > Now, I would fully agree if you question what's the benefit of posting this on GH and not on FB, for example, and what's in there to surprise the HN crowd. The author posted Wired's article about the tool on LinkedIn. Does Facebook host code and render Markdown? Does the author have a Facebook account? Would you bet your Facebook account they wouldn't consider it distributing a hacking tool and lock the account? Must it be surprising? Some in the HN crowd would want to explore their own databases I think. Some will have family and friends ask them about Recall security.
- pseudalopex 2y ago
  You interpreted a statement about saved screenshots in an article about Recall as a general claim about Windows security even the general public would know was false?
  - Dylan16807 2y ago
    I guess I worded that badly. Let me try again: I interpreted that line as analogous to normal Windows security. As a general rule, a would-be hacker can't get to any of your on-device data, Recall included, without a local user giving them access. So the intent of the statement is to say it's immune to anything else being hacked, like servers. Not to say they finally invented a completely hack-proof system... and only used it for this single program.
    - pseudalopex 2y ago
      > As a general rule, a would-be hacker can't get to any of your on-device data, Recall included, without a local user giving them access. Physical access means physical access to experts and the general public. Not physical access, social engineering, supply chain exploit, or remote code execution. Saying Windows can't be hacked without physical access would be false too. > So the intent of the statement is to say it's immune to anything else being hacked, like servers. Anything else would include Windows Update and Microsoft accounts. They said Recall snapshots were stored on the PC itself and not available to Microsoft. Adding a misleading description of Windows security did nothing but confuse people.

Dylan16807 2y ago

The BBC quote says "a would-be hacker". I interpreted that as a general claim about windows security, not saying that this particular feature is invisible to malware. They have to break the security of your particular device, the data is nowhere else.

smarx007 2y ago
> I interpreted that as a general claim about windows security Sure, because you understand that the other interpretation is nonsensical. All the publications that are popping up showing that the Recall DB is locally accessible are aimed at all the other Windows users. Now, I would fully agree if you question what's the benefit of posting this on GH and not on FB, for example, and what's in there to surprise the HN crowd.
- Dylan16807 2y ago
  > All the publications that are popping up showing that the Recall DB is locally accessible are aimed at all the other Windows users. See, that's the thing. Proving it's locally accessible... Microsoft never even implied it wasn't locally accessible.
  - pseudalopex 2y ago
    > Microsoft never even implied it wasn't locally accessible. BBC said Microsoft said a hacker would need physical access. You can think this meant to hack Recall or Windows.
    - Dylan16807 2y ago
      Right. They specifically laid out a scenario where the data is locally accessible. So code that proves the data is locally accessible doesn't contradict them.
      - pseudalopex 2y ago
        https://news.ycombinator.com/item?id=40579531 https://news.ycombinator.com/item?id=40579531
        Dylan16807 2y ago
        ? That comment thread is about a completely different thing at this point.
        pseudalopex 2y ago
        I assumed your meaning of local was consistent across comments. Was it not?
- pseudalopex 2y ago
  > Now, I would fully agree if you question what's the benefit of posting this on GH and not on FB, for example, and what's in there to surprise the HN crowd. The author posted Wired's article about the tool on LinkedIn. Does Facebook host code and render Markdown? Does the author have a Facebook account? Would you bet your Facebook account they wouldn't consider it distributing a hacking tool and lock the account? Must it be surprising? Some in the HN crowd would want to explore their own databases I think. Some will have family and friends ask them about Recall security.
pseudalopex 2y ago
You interpreted a statement about saved screenshots in an article about Recall as a general claim about Windows security even the general public would know was false?
- Dylan16807 2y ago
  I guess I worded that badly. Let me try again: I interpreted that line as analogous to normal Windows security. As a general rule, a would-be hacker can't get to any of your on-device data, Recall included, without a local user giving them access. So the intent of the statement is to say it's immune to anything else being hacked, like servers. Not to say they finally invented a completely hack-proof system... and only used it for this single program.
  - pseudalopex 2y ago
    > As a general rule, a would-be hacker can't get to any of your on-device data, Recall included, without a local user giving them access. Physical access means physical access to experts and the general public. Not physical access, social engineering, supply chain exploit, or remote code execution. Saying Windows can't be hacked without physical access would be false too. > So the intent of the statement is to say it's immune to anything else being hacked, like servers. Anything else would include Windows Update and Microsoft accounts. They said Recall snapshots were stored on the PC itself and not available to Microsoft. Adding a misleading description of Windows security did nothing but confuse people.