8 ms·
Microsoft Research chief scientist has no issue with Recall
- reify 2y agoSycophantic research chief scientist has no issues with Recall. He cant recall what he really thinks of recall due to the serious business of getting his "sandwiches wrapped in a road map" and sent on his way.
- ErikBjare 2y agoIt is a she
- abc123abc123 2y ago[flagged]
- kvaneijk 2y agoWe've launched a FOSS alternative with OpenRecall https://github.com/openrecall/openrecall https://github.com/openrecall/openrecall to (hopefully) work towards addressing some of the concerns people have with Windows Recall. We think it could be a useful feature but it must be (1) fully auditable/open source (2) using open source local models (3) focused on privacy/security and (4) hardware/OS independent. We're working out the roadmap currently so any feedback is appreciated.
- CodeCompost 2y agoWhy would I want this?
- tvt_123 2y agoUsefulness of Recall aside, If I wanted to try this out I would definately opt for an OS free alternative.
- fossr 2y agoSome people think it coukd genuinely be a useful feature, just like you can rewind your TV or a live stream to go back. It should really be open source however to be auditable for anyone.
- irthomasthomas 2y agoOthers find value in forgetting.
- sanitycheck 2y agoJust in case you have "difficult" employees you want to intrusively monitor who insist on using Linux instead of Windows, of course!
- freilanzer 2y agoIf it's completely open, local, and trustworthy, I would definitely use it as a database of my activities. To query for and find something you didn't bother saving, for example, or combine it with RAG would be incredible. Since it's screenshotting everything - passwords, sensitive information, etc. - it can in practice never be trustworthy, though.
- Brian_K_White 2y agoEven the theoretical legitimate usage is just nothing I ever wanted, certainly not nearly enough to spend the cpu, disk, and attack surface on. The value is microscopic and the cost and risk are not. I can think of no value in a mass of ocr'd screen shots that is remotely worth the cpu and disk cost of generating them or the security risk of them merely existing anywhere, even if the code to do it was gpl. And the real problem is not me anyway. I use linux. But not one of my relatives I care about does. They are all going to have these terrible things. I can directly take care of a few of them but not most. Not to mention just everyone else everywhere.
- TiredOfLife 2y agohttps://en.wikipedia.org/wiki/Memex https://en.wikipedia.org/wiki/Memex https://en.wikipedia.org/wiki/Lifelog https://en.wikipedia.org/wiki/Lifelog https://en.wikipedia.org/wiki/MyLifeBits https://en.wikipedia.org/wiki/MyLifeBits
- RicDan 2y agoThis is my personal opinion, but a big screenshot of Elon in the readme isn't doing you any favours.
- hnbad 2y agoA screenshot of one of his tweets no less. Yes, this is likely to leave a bad first impression for many people.
- whilenot-dev 2y agoI'm sorry to be that guy, but capturing screenshots is anything but "focused on privacy/security". It should be either: - browser only and semantically understand and hide sensitive information like password fields (or even all input fields) - or capture stuff from the display server and make it configurable which applications should be ignored (e.g. password manager), and even prompt with each newly opened window if the user wants to remember that session ...and that's just the basics, if we go into details I'm sure there's much more to it.
- WhackyIdeas 2y agoNo I won’t be installing your keylogger.
- rmm 2y agoPrivacy/security issues aside. It’s a really freaken useful tool that I’m already missing on other devices.
- timeon 2y agoConvenience yet again shows it will be downfall of humanity.
- rmm 2y agoI know. I know. Im hoping they secure it somehow without crippling it. But honestly, it’s like it was designed for the way I work. I dont have a trillion tabs open any more. I run multiple projects at once plus personal stuff throughout the day. Really really poor project management. But now I just go about what I’m doing and can pickup where I left off. Literal use case: I was writing a report for a client and had done a bunch of research on a topic, then got distracted as I remembered I needed to upgrade the homelab and wanted new unifi gear. Then got back on another project where I needed provide a summary of similar other projects we had worked on. So after I finished the last task, I quickly pulled up the research where and where I was at, it even found items I didn’t notice initially. Then at a day later I was able to pull up all the spec sites, reddit posts and recommendations and shopping sites I found for the cheapest place to buy my new gear. It was awesome. And that’s one of many many times it saved me.
- wolpoli 2y agoI have a different take on this. If the same feature were built on Android or iPhone, the data would be encrypted, and the researchers would have had a hard time accessing the SQLite file itself. Microsoft's takeaway from this negative news would be that it needs to lock down Windows 12 by adopting designs from Android and iPhone, effectively closing it off.
- KronisLV 2y agoIt would be good for security but horrible for usability. I recently got an iPhone and had to migrate to it from my Android phone which turned out to be really unpleasant because I could not carry over WhatsApp data. Turns out that the SQLite database is encrypted and I can’t easily carry it over, nor even get the encryption key in a non-rooted device. Furthermore, there is also the issue that Android only backs up to Google Drive whereas the iPhone only backs up to iCloud so I could not restore from backup either. A task that should have taken minutes took me hours and I had to buy some questionable software. https://blog.kronis.dev/everything%20is%20broken/iphone-android-and-whatsapp-are-broken https://blog.kronis.dev/everything%20is%20broken/iphone-andr...
- wolpoli 2y agoI also looked into transferring WhatsApp data from Android to IOS recently and there is an official way to transfer in both directions now. https://faq.whatsapp.com/686469079565350/?helpref=hc_fnav https://faq.whatsapp.com/686469079565350/?helpref=hc_fnav I didn't end up going through with it through since there was no way to take a Signal backup created in Android and restore it to IOS.
- KronisLV 2y ago> Your iPhone must be factory new or reset to factory settings to pair with the Move to iOS app and move data from your Android phone As I pointed out in the post, this was pretty much the dealbreaker for me. I had initially set up the iPhone without all of my accounts, just for development, but had gradually carried over my accounts and the apps I need to use. And then I find out that I’d basically need to wipe all of the progress and start over, just because the data move can’t be initiated with an already set up phone (which probably made developing the app easier, but at the same time limits its usefulness).
- leokennis 2y agoMy understanding is that the Recall database is basically a plaintext local sqlite DB, and the only security measure is that it is stored in a folder for which you need admin rights to access? If so, how is that excusable for a company like Microsoft? I'd say even a weekend hackathon project would implement more security than that?
- bsmartt 2y agowhere did you hear that? > Snapshots are encrypted by Device Encryption or BitLocker, which are enabled by default on Windows 11. Recall doesn't share snapshots with other users that are signed into Windows on the same device. Microsoft can't access or view the snapshots. You can delete your snapshots at any time by going to Settings > Privacy & security > Recall & snapshots on your PC. source: https://support.microsoft.com/en-us/windows/privacy-and-control-over-your-recall-experience-d404f672-7647-41e5-886c-a3c59680af15 https://support.microsoft.com/en-us/windows/privacy-and-cont...
- leokennis 2y agoSome excerpts from https://doublepulsar.com/recall-stealing-everything-youve-ever-typed-or-viewed-on-your-own-windows-pc-is-now-possible-da3e12e9465e https://doublepulsar.com/recall-stealing-everything-youve-ev...: ---------- Q. So how does it work? A. Every few seconds, screenshots are taken. These are automatically OCR’d by Azure AI, running on your device, and written into an SQLite database in the user’s folder. This database file has a record of everything you’ve ever viewed on your PC in plain text. OCR is a process of looking an image, and extracting the letters. Q. How do you obtain the database files? A. They’re just files in AppData, in the new CoreAIPlatform folder. Q. But it’s highly encrypted and nobody can access them, right?! A. Here’s a few second video of two Microsoft engineers accessing the folder: https://cyberplace.social/@GossiTheDog/112535509953161486 https://cyberplace.social/@GossiTheDog/112535509953161486 ----------
- rightbyte 2y agoOh dear. This sounds terrible from a privacy and security standpoint. Secret passwords where you press the "eye button", sensitive info ...
- Kina 2y agoIt is difficult to get someone to understand something when their salary depends upon them not understanding it.
- nixass 2y ago> it's a great question Whenever you hear or read this phrase during any sort of backlash you can expect bullshit answer
- EdwardDiego 2y agoWorking at a company in the healthcare space, this raises so many HIPPA compliance questions for our customers it's hilarious. And by hilarious, I mean bad. Screenshots of PHI? Sweet as, just chuck them in an SQLite DB, no worries there.
- bsmartt 2y agowell good news, this feature can be 100% disabled by your IT team, and you dont need these snapdragon high end consumer laptops in your hospital anyway. why am i having to defend microsoft? have we all lost our minds? or do we just shoot first, ask questions later for the lulz
- belter 2y agoPlease point to a documentation reference that shows an officially supported way, to completely disable all telemetry on Windows OS...
- TiredOfLife 2y agohttps://learn.microsoft.com/en-us/compliance/regulatory/offering-hipaa-hitech https://learn.microsoft.com/en-us/compliance/regulatory/offe...
- belter 2y agoThis is about Azure Cloud and Office 365. No mention of Windows OS. Also by the way...although unrelated to the question, does not by itself guarantee compliance, as addressed in the FAQ: "Does having a Business Associate Agreement with Microsoft ensure my organization's compliance with HIPAA and the HITECH Act?" "No. By offering a Business Associate Agreement, Microsoft helps support your HIPAA compliance. However, using Microsoft services does not on its own achieve HIPAA compliance..." Not to mention that HIPAA compliance specifically protects health information (ePHI). It does not cover other types of data, so companies like Microsoft can collect and use telemetry data without violating HIPAA, even if this raises privacy issues.
- ankurdhama 2y agoThe whole drama around with how Recall store data is misguided. The problem is not how this data is stored, it is more fundamental i.e how windows doesn't have a proper app sand boxing. MS App store apps have sandboxing and permission model but most of other apps on windows are still just bunch of DLLs and EXEs that run with all the permissions that the current user have. Until MS solves this problem there is no way to secure such things.
- barrkel 2y agoI don't want to run an operating system where I need to get the vendor's permission to run my own applications under my authority.
- Kototama 2y agoThis is not correlated. Android has sandboxing and you can run your own applications.
- barrkel 2y agoI can't run with full authority on Android, however. My own apps can't access my own data from other apps that I run. This is not something I can forego on my main computing device. I'm willing to tolerate it in a phone because it's just a tool; I wouldn't use a phone to store data I wouldn't mind losing.
- saagarjha 2y agoWhat kind of solution are you looking for here? The ability to sign your own apps with a platform signature?
- DougN7 2y agoThe ability to go in and grab your own data (which you have to do using some app or another), and do whatever you like with it, such as back it up, move it, inspect it, or try to get the data into a new app because the old app no longer runs for some reason.
- bsmartt 2y agoi dont understand why everyone is so confused and outraged. first off, it doesnt affect you. even if you do buy a microsoft laptop that is being marketed as the "ai powered technology revolotion" (or whatever), its shipping from the start with almost all the tools i can think of to help you only recall what you want. application exclusion by ifn, pause the stored data / purge stored data / or opt out forever. if you use edge, you can have it ignore incognito tabs or certain websites. The feature needs to be opt in without these restrictions set up because the people who might actually benefit here are people who don't want to be bothered with those power user features. like my grandma. anyone who is worried about screenshots leaking, do you guys remember photoshop? we already have keyloggers, banking trojans, infostealers, and for someone to access your recall screenshots they'll be in a position to infect your laptop with all the usual suspects in commodity malware. so they could start logging your keystrokes, pilfer your chrome browsing data, or they could start downloading a 25 GB file that they can't even decrypt, and (lets just allow them to decrpyt somehow). now they get the pleasure of looking through 25 gb of cat pics and reddit hoping they might find a picture of you logging into your bank where you toggle the show password field button. or maybe you don't ever reveal the password so he gets really mad because his ISP only gives him 30GB down / month and he just burned nearly all of it. he decides to dox you and your data, but there isnt anything connecting your real identity to these screenshots (which again, couldve been photoshopped, or you could create your win11 username as Sam Altman). And none of this is even going to happen this would be the first time ive ever heard of a hands on keyboard commodity malware controller who is targeting whomever he can breach and rather than just sitting back while keyloggers and bots phone home and exfil sensitive data as text in an automated way, he's at home dealing with these massive encrpyted archive files and bajillions of screenshots. everyone be triflin' over some bullshit here, you guys know why they did this right, not because its useful or a good use of AI. all the big guys are racing to cash in on the consumer AI market and they want to tell wall st on the quarterly earnings reports that theyve got a new go to market strategy with AI and its going to lead to N revenue, and instead of slightly faster hardware the next surface launch is gonna be huge marketing event and if you guys in nyc want to bet on ai for consumers, buy more microsoft stock. isnt this obvious my friends?
- WhackyIdeas 2y ago
- oldpersonintx 2y ago[dead]
- qlm 2y agoI swear I saw a comment or link on HN where somebody bemoaned a lack of innovation in computer interfaces, and provided some suggestions. What MS calls Recall is one of the things they suggested. When I saw Recall being announced I wondered if somebody at Microsoft had seen the same thing as me. If only there was some way for me to find it...
- surfingdino 2y agoMicrosoft Research should really drop "research" from its name. We are not talking Bell Labs-level of research here. They come up with the most useless "inventions" like Multimouse https://www.microsoft.com/en-us/research/blog/multimouse-makes-computer-learning-communal-experience/ https://www.microsoft.com/en-us/research/blog/multimouse-mak... so why are we surprised that Recall is criticised so much?
- nocsi 2y agoBut how is multimouse useless? The researcher identified a problem, investigated and produced a plausible solution. The entirety of it was driven by a ‘use’. Besides that, what would you propose calling this org that operates somewhat autonomously in an enclave within Microsoft but focuses entirely on research and is staffed entirely by PhDs and PIs?
- DougN7 2y agoI work for a company that has a product that, as part of other functionality, can selectively block access to any file, so it could simply block access to the database, or even the Recall exe/dlls themselves. We’ve been debating about releasing a simple/free “always block access to these files” app because of all the BS Microsoft is putting in. We’d probably do it under a separate company to protect the main product from retaliation. Is this of interest? What else do we need to think of?
- benterix 2y agoDefinitely do it under a different name, MS can be quite vindicative.
- DougN7 2y agoRealistically, who would ever use this? An OCR of everything on the screen, saved every few seconds? I can’t imagine finding something useful in a haystack of that size.
- VyseofArcadia 2y agoGive it a few years. MS will 100% be using data collected by Recall for advertising purposes. I'm sure it will be anonymized, or at least they will attempt to anonymize it. But it will happen. Part of the problem is that MS has never realigned their internal incentives with their stated goals. The best way to get a good bonus or a promotion is to deliver "impactful" features. Once recall is out there, teams will be chomping at the bit to (ab)use its data to quickly and easily demonstrate impact. Compounding the problem is that MS has no overarching product vision. No one there is really championing the sort of clean, functional, no-nonsense OS that we all know Windows could be. Or if they are, they are being drowned out by people who have dollar signs in their eyes. Compounding that problem is that ICs and teams are strongly encouraged to be "data-driven", which means a sense of product vision is outright ignored unless you can repeatedly and consistently make up metrics that work towards a clean, functional, no-nonsense OS. This is difficult when your metrics are things like, "did the A group click this button more than the B group".