4 ms·

Some excerpts from https://doublepulsar.com/recall-stealing-everything-youve-ever-typed-or-viewed-on-your-own-windows-pc-is-now-possible-da3e12e9465e https://do

Some excerpts from https://doublepulsar.com/recall-stealing-everything-youve-ever-typed-or-viewed-on-your-own-windows-pc-is-now-possible-da3e12e9465e https://doublepulsar.com/recall-stealing-everything-youve-ev...: ---------- Q. So how does it work? A. Every few seconds, screenshots are taken. These are automatically OCR’d by Azure AI, running on your device, and written into an SQLite database in the user’s folder. This database file has a record of everything you’ve ever viewed on your PC in plain text. OCR is a process of looking an image, and extracting the letters. Q. How do you obtain the database files? A. They’re just files in AppData, in the new CoreAIPlatform folder. Q. But it’s highly encrypted and nobody can access them, right?! A. Here’s a few second video of two Microsoft engineers accessing the folder: https://cyberplace.social/@GossiTheDog/112535509953161486 https://cyberplace.social/@GossiTheDog/112535509953161486 ----------

rightbyte 2y ago
Oh dear. This sounds terrible from a privacy and security standpoint. Secret passwords where you press the "eye button", sensitive info ...
bsmartt 2y ago
so official microsoft documentation vs infosec twitter. that's not how you back up an argument with proof. there are no microsoft engineers in that video. i see a laptop. is that from tiktok? how are you taking this guy's word for shit without even thinking? its like 13 seconds taken out of context showing a folder click and authorization (what's even happening here, is this an admin account?)
- leokennis 2y ago
  You are aware by whom vulnerabilities are usually discovered? Hint: it’s usually not by the companies that shipped them.
  - bsmartt 2y ago
    Following this logic you really shouldn’t use Microsoft products. Or Apple. Or google. Or Mozilla. Either way, you are better off with a bug in this dumb as hell feature than you are with a bug in your web browser. Yet here we are, spurging out over recall.
- bsmartt 2y ago
  We can talk about vulnerabilities that’s the first decent point I’ve seen in this entire comment section. So youre saying that since there will be vulnerabilities (discovered and hopefully patched quickly) this Is a privacy violation? If anything what you point out is good, we should all audit the feature on launch. Probably gonna be some good bug bounties here.
- btasker 2y ago
  > how are you taking this guy's word for shit without even thinking? For starters: * Because it's been confirmed and demonstrated by other people too? * Because Total Recall (https://github.com/xaitax/TotalRecall https://github.com/xaitax/TotalRecall) is a thing that you can try yourself? * Because Microsoft's entire response to concerns has basically been "oh it's fine, _trust us_"

rightbyte 2y ago

Oh dear. This sounds terrible from a privacy and security standpoint. Secret passwords where you press the "eye button", sensitive info ...

bsmartt 2y ago

so official microsoft documentation vs infosec twitter. that's not how you back up an argument with proof. there are no microsoft engineers in that video. i see a laptop. is that from tiktok? how are you taking this guy's word for shit without even thinking? its like 13 seconds taken out of context showing a folder click and authorization (what's even happening here, is this an admin account?)

leokennis 2y ago
You are aware by whom vulnerabilities are usually discovered? Hint: it’s usually not by the companies that shipped them.
- bsmartt 2y ago
  Following this logic you really shouldn’t use Microsoft products. Or Apple. Or google. Or Mozilla. Either way, you are better off with a bug in this dumb as hell feature than you are with a bug in your web browser. Yet here we are, spurging out over recall.
bsmartt 2y ago
We can talk about vulnerabilities that’s the first decent point I’ve seen in this entire comment section. So youre saying that since there will be vulnerabilities (discovered and hopefully patched quickly) this Is a privacy violation? If anything what you point out is good, we should all audit the feature on launch. Probably gonna be some good bug bounties here.
btasker 2y ago
> how are you taking this guy's word for shit without even thinking? For starters: * Because it's been confirmed and demonstrated by other people too? * Because Total Recall (https://github.com/xaitax/TotalRecall https://github.com/xaitax/TotalRecall) is a thing that you can try yourself? * Because Microsoft's entire response to concerns has basically been "oh it's fine, _trust us_"