3 ms·

I read the blog post and all I could feel was that if someone did the equivalent of running `chmod -R a+rwX ~` and then running an unauthenticated ssh server. T

I read the blog post and all I could feel was that if someone did the equivalent of running `chmod -R a+rwX ~` and then running an unauthenticated ssh server. Then yeah, they might have some security problems seen in that post. Their computer is probably already FUBAR from doing this as a habit though so...

haswell 2y ago
The point is that the user doesn’t need to do either of the things you mentioned. Privilege escalation is common and how malware often works. The impact of such escalation just went up significantly. You seem to be looking at this from the standpoint of a user doing dumb stuff things with their windows configuration (also common) vs. the very active ongoing malware campaigns against windows and how this changes the playing field for such malware and the makers of malware. In a world where privilege escalation is common and expected, it makes no sense to deploy a database of highly sensitive data without robust security. It’s a bit like storing money in your car in a city known for high rates of car theft.
- its-summertime 2y ago
  For Privilege Esc to be relevant, this would require having execution on the device already, but somehow not on user account (since then they wouldn't need to escalate to access recall data). If there was Priv Esc, then it doesn't matter how robust the security is because you make your way to root and you win regardless.
  - haswell 2y ago
    The point was that it’s unnecessary for a user to explicitly change the permissions of the home directory as you had described for the data to be at risk. I agree with your last paragraph, and that is exactly what makes Recall such a big problem, and why the security community is reacting strongly against this feature. Assuming the attacker wins, which they currently do on a regular basis, they get to know everything about everyone who has used the computer to a degree of detail that is unprecedented both in scope and in detail. The harm of losing this information to an attacker is potentially extreme, with obvious consequences. Since this is an opt-out feature, Microsoft has essentially guaranteed that a sizable portion of their user base will overnight start feeding attackers more details than they could have ever hoped for. It’s incompetent, irresponsible, and should be categorically rejected by the tech community. I say this while also seeing the value of such a feature if it could be implemented safely. I hope someone figures out a safe architecture because I could see a local model trained on everything I’ve ever done on my PC being a transformational capability. But I wouldn’t go near Recall at this point.
    - its-summertime 2y ago
      If Recall is such a big problem for that, then what of Thunderbird which would give your entire set of emails to anyone with read permissions, or Firefox which would give your email credentials and in turn your entire set of emails to anyone with read permissions. Unless you make a habit of going through all of your email archive one by one, that information is not going to be in recall. Same thing for Signal, Messenger, et al. Recall sees everything you see. Your credentials and local storage, cookies, cache, et al. see everything you see, and everything you don't see, and things you see on other devices too, and etc etc. - - - "Implemented safely" doesn't include security through obscurity. Past having an encrypted home directory, the only practical way to make it more secure than it currently is would be a separate device that records from tapping your monitor's cables.

haswell 2y ago

The point is that the user doesn’t need to do either of the things you mentioned. Privilege escalation is common and how malware often works. The impact of such escalation just went up significantly. You seem to be looking at this from the standpoint of a user doing dumb stuff things with their windows configuration (also common) vs. the very active ongoing malware campaigns against windows and how this changes the playing field for such malware and the makers of malware. In a world where privilege escalation is common and expected, it makes no sense to deploy a database of highly sensitive data without robust security. It’s a bit like storing money in your car in a city known for high rates of car theft.

its-summertime 2y ago
For Privilege Esc to be relevant, this would require having execution on the device already, but somehow not on user account (since then they wouldn't need to escalate to access recall data). If there was Priv Esc, then it doesn't matter how robust the security is because you make your way to root and you win regardless.
- haswell 2y ago
  The point was that it’s unnecessary for a user to explicitly change the permissions of the home directory as you had described for the data to be at risk. I agree with your last paragraph, and that is exactly what makes Recall such a big problem, and why the security community is reacting strongly against this feature. Assuming the attacker wins, which they currently do on a regular basis, they get to know everything about everyone who has used the computer to a degree of detail that is unprecedented both in scope and in detail. The harm of losing this information to an attacker is potentially extreme, with obvious consequences. Since this is an opt-out feature, Microsoft has essentially guaranteed that a sizable portion of their user base will overnight start feeding attackers more details than they could have ever hoped for. It’s incompetent, irresponsible, and should be categorically rejected by the tech community. I say this while also seeing the value of such a feature if it could be implemented safely. I hope someone figures out a safe architecture because I could see a local model trained on everything I’ve ever done on my PC being a transformational capability. But I wouldn’t go near Recall at this point.
  - its-summertime 2y ago
    If Recall is such a big problem for that, then what of Thunderbird which would give your entire set of emails to anyone with read permissions, or Firefox which would give your email credentials and in turn your entire set of emails to anyone with read permissions. Unless you make a habit of going through all of your email archive one by one, that information is not going to be in recall. Same thing for Signal, Messenger, et al. Recall sees everything you see. Your credentials and local storage, cookies, cache, et al. see everything you see, and everything you don't see, and things you see on other devices too, and etc etc. - - - "Implemented safely" doesn't include security through obscurity. Past having an encrypted home directory, the only practical way to make it more secure than it currently is would be a separate device that records from tapping your monitor's cables.