7 ms·

What's the difference between stealing some random sqlite database and the history of OCRs of screenshots of anything ypu did on that PC?

tssva 2y ago
What's the difference between stealing the history of OCRs of screenshots on anything you did versus the ability to steal my tax/financial documents, business trade secrets, private letters, photos and other information commonly stored on a computer which can be taken in the same manner whether it is on Windows, Linux or macOS?
- lolc 2y ago
  This Recall feature keeps text of emails typed and never sent, of documents viewed and deleted.
  - tssva 2y ago
    And that makes the security associated with it any more important than my kept documents how?
    - wkat4242 2y ago
      It's the more exposed thought process that shines a strong light into your mind. It's not just what you do but the why. It's no wonder collecting this info is a priority. It will be a goldmine for dataminers with the right correlation. Sure right now it's not collected centrally but I'm sure sooner or later there'll be a quick "just click off this tiny T&C update before you continue" crossing our paths. Also, it means that this confidential info is now in more places than one. It's no longer sufficient to encrypt a file and lay it on a usb stick in the safe. And it's also there in centralised place ripe for the taking. Not even any need to scan the system to find valuable information.
    - lolc 2y ago
      Text on screen can be more confidential than text on disk.
      - tssva 2y ago
        And it can be the other way around. I still don’t get why this demands some new level of security beyond what protects other data.
        lolc 2y ago
        So I want to read an encrypted mail, then delete it. What do I do?
        tssva 2y ago
        Disable the feature permanently or click the Recall icon on the system tray and quickly pause it while you read the encrypted email.
        lolc 2y ago
        Ok, what if I forget or don't know it's active?
        tssva 2y ago
        Then that is your fault and it is on you.
        lolc 2y ago
        Users will be blamed until security improves.
        tssva 2y ago
        God forbids users take any responsibility for their own security.
sunaookami 2y ago
If someone has admin access to your PC (which they need to access the SQLite file) they could also just install malware that sends everything you do and type over the network.
- pohuing 2y ago
  One difference is the speed apparently. You'd need the malware to be installed for a while. With recall you need to exfiltrate a couple kb of data that's already there on disk. That said, yeah, if the user interacts dumping saved passwords is trivial as well.
- hulitu 2y ago
  Someone like Microsoft ? /s

tssva 2y ago

What's the difference between stealing the history of OCRs of screenshots on anything you did versus the ability to steal my tax/financial documents, business trade secrets, private letters, photos and other information commonly stored on a computer which can be taken in the same manner whether it is on Windows, Linux or macOS?

lolc 2y ago
This Recall feature keeps text of emails typed and never sent, of documents viewed and deleted.
- tssva 2y ago
  And that makes the security associated with it any more important than my kept documents how?
  - wkat4242 2y ago
    It's the more exposed thought process that shines a strong light into your mind. It's not just what you do but the why. It's no wonder collecting this info is a priority. It will be a goldmine for dataminers with the right correlation. Sure right now it's not collected centrally but I'm sure sooner or later there'll be a quick "just click off this tiny T&C update before you continue" crossing our paths. Also, it means that this confidential info is now in more places than one. It's no longer sufficient to encrypt a file and lay it on a usb stick in the safe. And it's also there in centralised place ripe for the taking. Not even any need to scan the system to find valuable information.
  - lolc 2y ago
    Text on screen can be more confidential than text on disk.
    - tssva 2y ago
      And it can be the other way around. I still don’t get why this demands some new level of security beyond what protects other data.
      - lolc 2y ago
        So I want to read an encrypted mail, then delete it. What do I do?
        tssva 2y ago
        Disable the feature permanently or click the Recall icon on the system tray and quickly pause it while you read the encrypted email.
        lolc 2y ago
        Ok, what if I forget or don't know it's active?
        tssva 2y ago
        Then that is your fault and it is on you.
        lolc 2y ago
        Users will be blamed until security improves.
        tssva 2y ago
        God forbids users take any responsibility for their own security.

sunaookami 2y ago

If someone has admin access to your PC (which they need to access the SQLite file) they could also just install malware that sends everything you do and type over the network.

pohuing 2y ago
One difference is the speed apparently. You'd need the malware to be installed for a while. With recall you need to exfiltrate a couple kb of data that's already there on disk. That said, yeah, if the user interacts dumping saved passwords is trivial as well.
hulitu 2y ago
Someone like Microsoft ? /s