6 ms·

Your browsing history is unlikely to contain personal information, secrets, porn images etc. And if you use Chrome, they get your full browsing history by defau

Your browsing history is unlikely to contain personal information, secrets, porn images etc. And if you use Chrome, they get your full browsing history by default. I get your point, but Microsoft's Recall can capture anything onscreen - emails, personal info, porn, passwords and the like. And it feels, bizarrely for 2024, that little thought has gone into privacy or security.

axus 2y ago
It's analogous to phone call metadata vs. the contents of the phone calls.
- GordonS 2y ago
  Yes, it's a good way to put it. Though it's worse in some respects, since AI will add "context" to the "contents" too.
- giobox 2y ago
  Perhaps. A key difference though - history files can include the individual pages I requested from the same host. Right now I have like 50 entries for the various posts I read just from HackerNews, all as separate line items etc etc. In the case of the phone, one simply sees recipient of call, duration etc, regardless of how much information was exchanged. The phone I'm calling is arguably analogous to the server I request a page from, in the metadata context. I'd argue browser history is significantly richer in some regards due to this. It's not unheard of for user identifiers to appear in URL paths either - try visiting https://news.ycombinator.com/user?id=<HN https://news.ycombinator.com/user?id=<HN user name>... In my Chrome, that's instantly in the history file with my username.
  - BoredPositron 2y ago
    It won't save your passwords in clear text though.
    - deafpolygon 2y ago
      No but it can reveal all of your accounts if you have more than one.
- stuartriffle 2y ago
  The language spoken by participants during a phone call is also easily classified as “metadata” and could be defended as non-identifiable info with a straight face. So are the number of speakers on the call, the topics of conversation, the intensity of emotions displayed, voice stress levels, and the presence of certain keywords, if you squint a little. The lack of a literal call transcript does not matter much in terms of privacy. I don’t know anything about this system, but the fact that screen shots are not ultimately stored on the user’s PC doesn’t mean anything if the content has already been classified and indexed. It will be fished.
nomel 2y ago
> that little thought has gone into privacy or security. I think the thought is proportional to the amount of thought a non-tech customer will put into it. Nobody seems to care about or understands privacy these days. Everyone knows they're being tracked everywhere they go physically and on the web. People use their real names, address, etc for every junk service they sign up for, without seeing any reason not to. If you tell people that their TV is tracking and taking screenshots of what they watch [1], they say "yeah, Netflix knows too". It's literally, "how it's always been" for any non tech person under 30. [1] https://themarkup.org/privacy/2023/12/12/your-smart-tv-knows-what-youre-watching https://themarkup.org/privacy/2023/12/12/your-smart-tv-knows...
- haswell 2y ago
  > I think the thought is proportional to the amount of thought a non-tech customer will put into it. Part of me wonders if this is the consequence of how accessible tech has become, and the prevalence of increasingly non-technical product managers. I'm a former PM, and I'm not here to denigrate the PM role, but the fact that a product like Recall got shipped says a lot about the makeup of the product org that shipped it. While I get that younger people tend to see privacy differently, I'd argue this isn't really a privacy issue, it's a security conversation, albeit with obvious privacy implications. Leaking what apps I use or what sites I visit is mostly a privacy issue. Leaking what I type into the boxes on those sites is a security issue. If the end result of leaking this info is the attacker can pwn all of my bank accounts, we're solidly into security territory. The fact that this got shipped means that multiple levels of leadership either didn't think about the consequences or didn't care about the consequences. I hope it's the former, because that means they can learn from the backlash and hopefully recalibrate. Microsoft is in a position of power that IMO requires a significant duty of care and responsibility to their customers, and lapses like this need to be judged through that lens, i.e. it is their entire business to make sure features like this are safe.
  - xattt 2y ago
    > The fact that this got shipped means that multiple levels of leadership either didn't think about the consequences or didn't care about the consequences. I hope it's the former, because that means they can learn from the backlash and hopefully recalibrate. There was probably from lower decks, where they are closer to reality. However, people are scared for their jobs in this economy and likely didn’t take it farther.
ragnese 2y ago
> And it feels, bizarrely for 2024, that little thought has gone into privacy or security. No, no. They thought about the privacy and security aspect. They decided that it's better for their bottom line if Windows users don't have privacy from the mother ship. Really, they already decided that way back when Windows Vista first came out and periodically asked Microsoft HQ if you should continue being allowed to use your computer.
- Sharlin 2y ago
  I mean, you can't even install Windows 10 without it telling you several times that unless you opt out (again and again), it's going to send just about anything you do to Microsoft…
- WhackyIdeas 2y ago
  I can see malware secretly enabling Recall and hopping on it as a really good keylogger which they don’t need to code themselves.
- bitwize 2y ago
  That was XP, and that was the beginning of my separation from Microsoft stuff in earnest. The Windows XP background and UI is a source of nostalgia for millennials just like Windows 3.x, old-school Mac, or Amiga would be for people my age... but I feel no nostalgia at all for it because I let that generation of Windows, and most subsequent ones, simply pass me by, fortune having smiled upon me and enabled me to work in Linux almost exclusively since around that time.
SketchySeaBeast 2y ago
I think they actually did consider that - that's why they emphasized it was all on device. They thought about it, they just didn't think about how little we would trust that promise.
- pydry 2y ago
  I'm perplexed that anybody thinks Microsoft were being dumb. They know exactly what they are doing and putting the pieces in place to violate users' security is the point. Theyre just boiling the frog slowly. It'll be turned on by default soon enough and then theyll start looking for excuses to upload it. This can be used to make them a shedload of money one day.
  - jasonfarnon 2y ago
    I agree, these decisions in 2024 are thoroughly vetted. I think the only thing these companies don't know is when the news cycle will pick up on something they're doing and they get blowback, and they'll have to pretend this was some little oversight.
    - WhackyIdeas 2y ago
      Honestly, it has the smell of an NSA pressure campaign which would also rake in the money like nobodies business.. an easy choice for Microsoft. They are as guilty as sin for turning everything they create into a surveillance product. I was just remembering today what they did to the security/encryption as soon as they bought over Skype… they removed it. And who would that benefit - the spies. No-one cared about that. No-one ever cares. Except for this rare occasion - tides are turning and people are starting to care a tad more.
  - WhackyIdeas 2y ago
    Totally. They just thought nobody would give a fuck. Except, people did. And now Adobe is getting it too.
    - 2y ago
INGSOCIALITE 2y ago
on the contrary, i think a LOT of thought went into privacy and security. specifically, how to ignore and bypass it.
thaumasiotes 2y ago
> Your browsing history is unlikely to contain [...] porn images Of all the places on your computer that might contain porn images, that would be one of the very top candidates.
- GordonS 2y ago
  Nope - links to porn sites (but who browses porn without Incognito Mode! :), but it's not going to contain actual images.
  - thaumasiotes 2y ago
    As far as metadata versus data, the URL of a static image automatically discloses the image itself. The only way to claim that the history doesn't actually contain the image is if you assume that the site has gone defunct. Unless, of course, you're willing to argue that a porn image stored on the local hard drive isn't contained in any folders on the same PC that soft-link it. You might have an interesting time trying to justify why it is contained in folders that hard-link it.
    - filleduchaos 2y ago
      Am I confused about what browser history is or what? Unless you open a static image in a new tab to look at it or you download it (as opposed to simply looking at it on the page it's on), then how on earth would its URL show up in browser history, which by definition tracks user-visited webpages (i.e. top-level links) and not every single URL the browser makes a request to? Sure, info about non-top-level links is extractable from e.g. request caches, but that's a different thing from the browser history SQLite DB.
      - thaumasiotes 2y ago
        It sounds like you're mostly just confused about how web pages work. Here is the URL of an image as it appears in your browser history: https://cheezburger.com/10357071872/if-i-fits-i-sits https://cheezburger.com/10357071872/if-i-fits-i-sits See if you can figure out what image I was looking at.
TiredOfLife 2y ago
No thought at all. Just by default auto exclude private browser windows and password managers. No thought at all.
- GordonS 2y ago
  It's a turn of phrase; it doesn't mean literally no though at all! On a more relevant note, how can it know when a private browser window is open in anything other than Edge? Same question with the password manager - is there going to be some new API that apps have to "opt in" to to enable Windows to recognise them?
shawnz 2y ago
What about the browser cache? And isn't there some capability in many browsers to store form field contents when navigating back/forward too?
- autoexec 2y ago
  At this point browser cache is known to everyone, and many people do clear it regularly. Browsers save passwords and form data but as far as I know they don't upload that data to Google. Still, chrome is very popular and it sends google people's browsing history and all their DNS traffic.
  - shawnz 2y ago
    Yeah, but in theory Recall doesn't upload anything either, which is why it's analogous. And in fact Chrome does upload passwords, and they're not even E2E encrpyted in the default configuration.

axus 2y ago

It's analogous to phone call metadata vs. the contents of the phone calls.

GordonS 2y ago
Yes, it's a good way to put it. Though it's worse in some respects, since AI will add "context" to the "contents" too.
giobox 2y ago
Perhaps. A key difference though - history files can include the individual pages I requested from the same host. Right now I have like 50 entries for the various posts I read just from HackerNews, all as separate line items etc etc. In the case of the phone, one simply sees recipient of call, duration etc, regardless of how much information was exchanged. The phone I'm calling is arguably analogous to the server I request a page from, in the metadata context. I'd argue browser history is significantly richer in some regards due to this. It's not unheard of for user identifiers to appear in URL paths either - try visiting https://news.ycombinator.com/user?id=<HN https://news.ycombinator.com/user?id=<HN user name>... In my Chrome, that's instantly in the history file with my username.
- BoredPositron 2y ago
  It won't save your passwords in clear text though.
  - deafpolygon 2y ago
    No but it can reveal all of your accounts if you have more than one.
stuartriffle 2y ago
The language spoken by participants during a phone call is also easily classified as “metadata” and could be defended as non-identifiable info with a straight face. So are the number of speakers on the call, the topics of conversation, the intensity of emotions displayed, voice stress levels, and the presence of certain keywords, if you squint a little. The lack of a literal call transcript does not matter much in terms of privacy. I don’t know anything about this system, but the fact that screen shots are not ultimately stored on the user’s PC doesn’t mean anything if the content has already been classified and indexed. It will be fished.

nomel 2y ago

> that little thought has gone into privacy or security. I think the thought is proportional to the amount of thought a non-tech customer will put into it. Nobody seems to care about or understands privacy these days. Everyone knows they're being tracked everywhere they go physically and on the web. People use their real names, address, etc for every junk service they sign up for, without seeing any reason not to. If you tell people that their TV is tracking and taking screenshots of what they watch [1], they say "yeah, Netflix knows too". It's literally, "how it's always been" for any non tech person under 30. [1] https://themarkup.org/privacy/2023/12/12/your-smart-tv-knows-what-youre-watching https://themarkup.org/privacy/2023/12/12/your-smart-tv-knows...

haswell 2y ago
> I think the thought is proportional to the amount of thought a non-tech customer will put into it. Part of me wonders if this is the consequence of how accessible tech has become, and the prevalence of increasingly non-technical product managers. I'm a former PM, and I'm not here to denigrate the PM role, but the fact that a product like Recall got shipped says a lot about the makeup of the product org that shipped it. While I get that younger people tend to see privacy differently, I'd argue this isn't really a privacy issue, it's a security conversation, albeit with obvious privacy implications. Leaking what apps I use or what sites I visit is mostly a privacy issue. Leaking what I type into the boxes on those sites is a security issue. If the end result of leaking this info is the attacker can pwn all of my bank accounts, we're solidly into security territory. The fact that this got shipped means that multiple levels of leadership either didn't think about the consequences or didn't care about the consequences. I hope it's the former, because that means they can learn from the backlash and hopefully recalibrate. Microsoft is in a position of power that IMO requires a significant duty of care and responsibility to their customers, and lapses like this need to be judged through that lens, i.e. it is their entire business to make sure features like this are safe.
- xattt 2y ago
  > The fact that this got shipped means that multiple levels of leadership either didn't think about the consequences or didn't care about the consequences. I hope it's the former, because that means they can learn from the backlash and hopefully recalibrate. There was probably from lower decks, where they are closer to reality. However, people are scared for their jobs in this economy and likely didn’t take it farther.

ragnese 2y ago

> And it feels, bizarrely for 2024, that little thought has gone into privacy or security. No, no. They thought about the privacy and security aspect. They decided that it's better for their bottom line if Windows users don't have privacy from the mother ship. Really, they already decided that way back when Windows Vista first came out and periodically asked Microsoft HQ if you should continue being allowed to use your computer.

Sharlin 2y ago
I mean, you can't even install Windows 10 without it telling you several times that unless you opt out (again and again), it's going to send just about anything you do to Microsoft…
WhackyIdeas 2y ago
I can see malware secretly enabling Recall and hopping on it as a really good keylogger which they don’t need to code themselves.
bitwize 2y ago
That was XP, and that was the beginning of my separation from Microsoft stuff in earnest. The Windows XP background and UI is a source of nostalgia for millennials just like Windows 3.x, old-school Mac, or Amiga would be for people my age... but I feel no nostalgia at all for it because I let that generation of Windows, and most subsequent ones, simply pass me by, fortune having smiled upon me and enabled me to work in Linux almost exclusively since around that time.

SketchySeaBeast 2y ago

I think they actually did consider that - that's why they emphasized it was all on device. They thought about it, they just didn't think about how little we would trust that promise.

pydry 2y ago
I'm perplexed that anybody thinks Microsoft were being dumb. They know exactly what they are doing and putting the pieces in place to violate users' security is the point. Theyre just boiling the frog slowly. It'll be turned on by default soon enough and then theyll start looking for excuses to upload it. This can be used to make them a shedload of money one day.
- jasonfarnon 2y ago
  I agree, these decisions in 2024 are thoroughly vetted. I think the only thing these companies don't know is when the news cycle will pick up on something they're doing and they get blowback, and they'll have to pretend this was some little oversight.
  - WhackyIdeas 2y ago
    Honestly, it has the smell of an NSA pressure campaign which would also rake in the money like nobodies business.. an easy choice for Microsoft. They are as guilty as sin for turning everything they create into a surveillance product. I was just remembering today what they did to the security/encryption as soon as they bought over Skype… they removed it. And who would that benefit - the spies. No-one cared about that. No-one ever cares. Except for this rare occasion - tides are turning and people are starting to care a tad more.
- WhackyIdeas 2y ago
  Totally. They just thought nobody would give a fuck. Except, people did. And now Adobe is getting it too.
  - 2y ago

INGSOCIALITE 2y ago

on the contrary, i think a LOT of thought went into privacy and security. specifically, how to ignore and bypass it.

thaumasiotes 2y ago

> Your browsing history is unlikely to contain [...] porn images Of all the places on your computer that might contain porn images, that would be one of the very top candidates.

GordonS 2y ago
Nope - links to porn sites (but who browses porn without Incognito Mode! :), but it's not going to contain actual images.
- thaumasiotes 2y ago
  As far as metadata versus data, the URL of a static image automatically discloses the image itself. The only way to claim that the history doesn't actually contain the image is if you assume that the site has gone defunct. Unless, of course, you're willing to argue that a porn image stored on the local hard drive isn't contained in any folders on the same PC that soft-link it. You might have an interesting time trying to justify why it is contained in folders that hard-link it.
  - filleduchaos 2y ago
    Am I confused about what browser history is or what? Unless you open a static image in a new tab to look at it or you download it (as opposed to simply looking at it on the page it's on), then how on earth would its URL show up in browser history, which by definition tracks user-visited webpages (i.e. top-level links) and not every single URL the browser makes a request to? Sure, info about non-top-level links is extractable from e.g. request caches, but that's a different thing from the browser history SQLite DB.
    - thaumasiotes 2y ago
      It sounds like you're mostly just confused about how web pages work. Here is the URL of an image as it appears in your browser history: https://cheezburger.com/10357071872/if-i-fits-i-sits https://cheezburger.com/10357071872/if-i-fits-i-sits See if you can figure out what image I was looking at.

TiredOfLife 2y ago

No thought at all. Just by default auto exclude private browser windows and password managers. No thought at all.

GordonS 2y ago
It's a turn of phrase; it doesn't mean literally no though at all! On a more relevant note, how can it know when a private browser window is open in anything other than Edge? Same question with the password manager - is there going to be some new API that apps have to "opt in" to to enable Windows to recognise them?

shawnz 2y ago

What about the browser cache? And isn't there some capability in many browsers to store form field contents when navigating back/forward too?

autoexec 2y ago
At this point browser cache is known to everyone, and many people do clear it regularly. Browsers save passwords and form data but as far as I know they don't upload that data to Google. Still, chrome is very popular and it sends google people's browsing history and all their DNS traffic.
- shawnz 2y ago
  Yeah, but in theory Recall doesn't upload anything either, which is why it's analogous. And in fact Chrome does upload passwords, and they're not even E2E encrpyted in the default configuration.