4 ms·

where did you hear that? > Snapshots are encrypted by Device Encryption or BitLocker, which are enabled by default on Windows 11. Recall doesn't share snapshot

where did you hear that? > Snapshots are encrypted by Device Encryption or BitLocker, which are enabled by default on Windows 11. Recall doesn't share snapshots with other users that are signed into Windows on the same device. Microsoft can't access or view the snapshots. You can delete your snapshots at any time by going to Settings > Privacy & security > Recall & snapshots on your PC. source: https://support.microsoft.com/en-us/windows/privacy-and-control-over-your-recall-experience-d404f672-7647-41e5-886c-a3c59680af15 https://support.microsoft.com/en-us/windows/privacy-and-cont...

leokennis 2y ago
Some excerpts from https://doublepulsar.com/recall-stealing-everything-youve-ever-typed-or-viewed-on-your-own-windows-pc-is-now-possible-da3e12e9465e https://doublepulsar.com/recall-stealing-everything-youve-ev...: ---------- Q. So how does it work? A. Every few seconds, screenshots are taken. These are automatically OCR’d by Azure AI, running on your device, and written into an SQLite database in the user’s folder. This database file has a record of everything you’ve ever viewed on your PC in plain text. OCR is a process of looking an image, and extracting the letters. Q. How do you obtain the database files? A. They’re just files in AppData, in the new CoreAIPlatform folder. Q. But it’s highly encrypted and nobody can access them, right?! A. Here’s a few second video of two Microsoft engineers accessing the folder: https://cyberplace.social/@GossiTheDog/112535509953161486 https://cyberplace.social/@GossiTheDog/112535509953161486 ----------
- rightbyte 2y ago
  Oh dear. This sounds terrible from a privacy and security standpoint. Secret passwords where you press the "eye button", sensitive info ...
- bsmartt 2y ago
  so official microsoft documentation vs infosec twitter. that's not how you back up an argument with proof. there are no microsoft engineers in that video. i see a laptop. is that from tiktok? how are you taking this guy's word for shit without even thinking? its like 13 seconds taken out of context showing a folder click and authorization (what's even happening here, is this an admin account?)
  - leokennis 2y ago
    You are aware by whom vulnerabilities are usually discovered? Hint: it’s usually not by the companies that shipped them.
    - bsmartt 2y ago
      Following this logic you really shouldn’t use Microsoft products. Or Apple. Or google. Or Mozilla. Either way, you are better off with a bug in this dumb as hell feature than you are with a bug in your web browser. Yet here we are, spurging out over recall.
  - bsmartt 2y ago
    We can talk about vulnerabilities that’s the first decent point I’ve seen in this entire comment section. So youre saying that since there will be vulnerabilities (discovered and hopefully patched quickly) this Is a privacy violation? If anything what you point out is good, we should all audit the feature on launch. Probably gonna be some good bug bounties here.
  - btasker 2y ago
    > how are you taking this guy's word for shit without even thinking? For starters: * Because it's been confirmed and demonstrated by other people too? * Because Total Recall (https://github.com/xaitax/TotalRecall https://github.com/xaitax/TotalRecall) is a thing that you can try yourself? * Because Microsoft's entire response to concerns has basically been "oh it's fine, _trust us_"
worthless-trash 2y ago
> Microsoft can't access or view the snapshots. And yet.. > Q. So how does it work? > A. Every few seconds, screenshots are taken. These are automatically OCR’d by Azure AI, running on your device, and written into an SQLite database in the user’s folder. Heads up, Microsoft runs azure. They likely get it before the local users database does.
- bsmartt 2y ago
  right, azure ai running on your device. microsoft cannot access shit on your device. by saying this, you are also claiming microsoft has windows 11 backdoored. and thanks for the heads up, thats news to me.
  - worthless-trash 2y ago
    Azure AI isn't the hosted service ? ( https://azure.microsoft.com/en-au/solutions/ai https://azure.microsoft.com/en-au/solutions/ai ? )

leokennis 2y ago

Some excerpts from https://doublepulsar.com/recall-stealing-everything-youve-ever-typed-or-viewed-on-your-own-windows-pc-is-now-possible-da3e12e9465e https://doublepulsar.com/recall-stealing-everything-youve-ev...: ---------- Q. So how does it work? A. Every few seconds, screenshots are taken. These are automatically OCR’d by Azure AI, running on your device, and written into an SQLite database in the user’s folder. This database file has a record of everything you’ve ever viewed on your PC in plain text. OCR is a process of looking an image, and extracting the letters. Q. How do you obtain the database files? A. They’re just files in AppData, in the new CoreAIPlatform folder. Q. But it’s highly encrypted and nobody can access them, right?! A. Here’s a few second video of two Microsoft engineers accessing the folder: https://cyberplace.social/@GossiTheDog/112535509953161486 https://cyberplace.social/@GossiTheDog/112535509953161486 ----------

rightbyte 2y ago
Oh dear. This sounds terrible from a privacy and security standpoint. Secret passwords where you press the "eye button", sensitive info ...
bsmartt 2y ago
so official microsoft documentation vs infosec twitter. that's not how you back up an argument with proof. there are no microsoft engineers in that video. i see a laptop. is that from tiktok? how are you taking this guy's word for shit without even thinking? its like 13 seconds taken out of context showing a folder click and authorization (what's even happening here, is this an admin account?)
- leokennis 2y ago
  You are aware by whom vulnerabilities are usually discovered? Hint: it’s usually not by the companies that shipped them.
  - bsmartt 2y ago
    Following this logic you really shouldn’t use Microsoft products. Or Apple. Or google. Or Mozilla. Either way, you are better off with a bug in this dumb as hell feature than you are with a bug in your web browser. Yet here we are, spurging out over recall.
- bsmartt 2y ago
  We can talk about vulnerabilities that’s the first decent point I’ve seen in this entire comment section. So youre saying that since there will be vulnerabilities (discovered and hopefully patched quickly) this Is a privacy violation? If anything what you point out is good, we should all audit the feature on launch. Probably gonna be some good bug bounties here.
- btasker 2y ago
  > how are you taking this guy's word for shit without even thinking? For starters: * Because it's been confirmed and demonstrated by other people too? * Because Total Recall (https://github.com/xaitax/TotalRecall https://github.com/xaitax/TotalRecall) is a thing that you can try yourself? * Because Microsoft's entire response to concerns has basically been "oh it's fine, _trust us_"

worthless-trash 2y ago

> Microsoft can't access or view the snapshots. And yet.. > Q. So how does it work? > A. Every few seconds, screenshots are taken. These are automatically OCR’d by Azure AI, running on your device, and written into an SQLite database in the user’s folder. Heads up, Microsoft runs azure. They likely get it before the local users database does.

bsmartt 2y ago
right, azure ai running on your device. microsoft cannot access shit on your device. by saying this, you are also claiming microsoft has windows 11 backdoored. and thanks for the heads up, thats news to me.
- worthless-trash 2y ago
  Azure AI isn't the hosted service ? ( https://azure.microsoft.com/en-au/solutions/ai https://azure.microsoft.com/en-au/solutions/ai ? )