10 ms·

This is confusing and vague to me, which I believe is exactly the intent. It focuses on security, reiterates that security is their top priority (and we know th

This is confusing and vague to me, which I believe is exactly the intent. It focuses on security, reiterates that security is their top priority (and we know that this is untrue). What were the security problems? They don't even allude to the existence or detection of any specific security problems. It sounds to me like they're figuring out a new marketing approach, or they're softening the blow by "listening to users" and then rolling out more slowly, when outrage has died down and people will just accept it.

pcloadletter_ 2y ago
Or maybe they have to figure out how to actually make it work
- deleted 2y ago
  [deleted]
segasaturn 2y ago
My takeaway is that Microsoft has been trying to boil the frog, but slipped and turned the temperature up too quickly. They're retreating for now, but make no mistake that Recall will slowly trickle back into Windows under another name. Every major power broker wants something like Recall to become the norm - bosses to spy on their employees, governments to spy on their citizens/enemies, and tech CEO's to collect training data for AI and target more ads at end users.
- ttyprintk 2y ago
  I expect it to emerge as an accessibility feature for cognitive memory loss. Imagine not remembering the name of your email client or the color of its icon, but Siri With Screenshots can pull up an important email thread.
  - vundercind 2y ago
    Christ. I just went through this stuff with a loved one, for a few years. “Hey Siri, what did mom do today?” “Asked 214 times when you were getting back in town, because she has not seen you in a long time.” “I’ve been back for two months and I saw her this morning.” “That is what I told her, each time.” “Ok. What else did she do?” “Nothing.” Yeesh. Some Black Mirror shit. [edit] not to crap on how nice that really might be for a lot of people. Dementia’s just… well, pretty messed up and sad, I guess, and bringing machines into the mix can be weird.
- ugjka 2y ago
  There are already Recall type of products on the market, not just that, they also work on the cloud not just locally. All Microsoft had to do was make it opt in by default
  - bostik 2y ago
    Yes, these existing products are generally called RATs or spousal stalkerware.
    - ugjka 2y ago
      No
- simonw 2y ago
  This is a very cynical take. I've not seen anything to make me think this feature is intended for surveillance as opposed to personal utility. The personal utility benefits are very clear to me - the problem is the ease with which malicious attackers might steal the data (if they can breach the system).
  - digging 2y ago
    > I've not seen anything to make me think this feature is intended for surveillance It's published by Microsoft
    - nonrandomstring 2y ago
      tbh that's a knockdown argument. All the conversation second guessing the intent and motives of bosses, users and third parties is moot when it runs on an OS that is controlled remotely and insecure by design. Apple are following, (and I exlect you'll have even less choice about that - because its clientsode scanning in disguise) and Google have always been proud of their surveillance based business model, so I think the whole landscape of big provider computing is changing. People are actually starting to question what they want computer devices for
  - surfingdino 2y ago
    TPM was met with resistance due to privacy concerns and Microsoft quietly re-introduced it anyway. The same will happen to Recall.
    - brookst 2y ago
      Has TPM been a net positive or negative for users / enterprises / the industry?
      - ekidd 2y ago
        TPM protects against two main threat models: 1. You don't trust people with physical access to the computer. For the average home user, this means you consider the hardware owner a threat. 2. You want to protect against malware that has already taken complete control over the OS at runtime, and that wants to write itself to disk or the BIOS so that it survives a reboot. At this point, the attacker has already won, so... This might make sense on a stateless appliance like a Chromebook where you do factory wipes a lot. So TPM mostly "protects" against the hardware owner, or against malware that already has 100% access to all user data, and just wants to stick around a bit longer. Personally, I'd go with TPM being net negative, because the primary threat model it "protects" against is the actual hardware owner.
- tivert 2y ago
  > Every major power broker wants something like Recall to become the norm - bosses to spy on their employees... Isn't that already the norm, or at least very very common? It's just a 3rd party package totally focused on surveillance, not built into the OS and used for some user-accessible features. > ...governments to spy on their citizens/enemies, and tech CEO's to collect training data for AI and target more ads at end users. These applications would be novel, at least on a widespread basis in Western liberal democracies.
  - segasaturn 2y ago
    >These applications would be novel, at least on a widespread basis in Western liberal democracies. How? We already know Google trains its AI on people's private emails and Five Eyes conducts mass surveillance on Western citizens (see: Snowden). You can be sure that the people behind the PRISM program are salivating at the thought of access to the unencrypted Recall databases, and that they'll be twisting Microsoft's arm for backdoor access.
    - tivert 2y ago
      >> These applications would be novel, at least on a widespread basis in Western liberal democracies. > How? We already know... I think you're making the mistake of interpreting this as a binary thing, which obscures the difference between, for instance, tapping phone calls and installing bugs in every room of everyone's home (a la 1984's telescreens). Or in this case, Google scanning the emails you sent/stored on their servers vs. Microsoft storing and scanning every action you take on your PC. It would be novel because most people outside a corporate environment don't have a keylogger/screen-recorder running on their system.
    - lrem 2y ago
      > We already know Google trains its AI on people's private emails Source?
- Hasu 2y ago
  > They're retreating for now, but make no mistake that Recall will slowly trickle back into Windows under another name. Not even that. It's still coming, under the same name, just not as soon for everyone.
- golemotron 2y ago
  I can't believe that no one there didn't anticipate the blowback. It could just have been a way for Satya to put the feature in front of their business customers. They'd likely want that feature even if consumers reject it.
- albert_e 2y ago
  Employers can collect task/business process staps by recording the screens. This will help train RPA bots and reduce the need for human workforce for repetitive tasks. Microsoft can collect this data across industries with or without informed consent and sell RPA/AI bots back to the same enterprise customers as a managed service. Lot of commercial potential there for the taking. Just needs a innocuous enough cover story ro make it a default offering to server you the individual customer alone and help you gain an edge over your peers.
swatcoder 2y ago
There's a much more mundane read: They invested a bunch of effort into a product the market loudly rejected. They're now withdrawing the product while they figure out what they can salvage from the effort. Key stakeholders may have a few ideas about how to proceed (ranging from "try again later" through "repurpose it" to "forget it"), but enterprises of Microsoft size make decisions very slowly so of course it's vague about what's next. Collectively, they almost certainly don't know!
- consumer451 2y ago
  In addition to direct market reaction, they must be a bit red in the face considering that Apple just laid out a complex and well thought out implementation of "AI", which focused on privacy. As someone who grew up near Redmond, who still has an emotional soft-spot for Microsoft for some reason, I feel truly embarrassed for their implementation.
  - pjmlp 2y ago
    From all three major OS vendors on the consumer market, Microsoft is still the one that pushes more C and C++ into production on their OS, in detriment of .NET, despite all the security discussions. All the efforts from other teams to have .NET reach Swift, Java, Kotlin levels of adoption on Windows, have always hit a wall against WinDev culture. Also the 90's spirit from features over security hasn't yet gone away from WinDev, so it isn't really surprising this turned out this way.
    - consumer451 2y ago
      My personal feelings aside, Microsoft is Too Big to Suck like this, regarding security and privacy. At this point, their culture is a national security liability. We have seen some recent efforts, but how does one right such a large ship? https://www.theregister.com/2024/06/14/brad_smith_microsoft_hearing/ https://www.theregister.com/2024/06/14/brad_smith_microsoft_... https://www.theverge.com/2024/4/3/24119787/microsoft-cloud-email-hack-china-us-cyber-report https://www.theverge.com/2024/4/3/24119787/microsoft-cloud-e...
idkdotcom 2y ago
[dead]
deleted 2y ago
[deleted]
pjmlp 2y ago
Currently I am still looking forward to when the Secure Future Initiative (SFI) will actually mean more .NET and Rust and less COM and C++ love by Windows team. So until this changes, take with a grain of salt how much secure Recall is actually going to be. Contrast this with Apple Inteligence, where not only are most local APIs made available via Swift, they have created special hardware and a unikernel like OS with sandboxed layers, exposing only what OS capabilities required for AI processing and cluster communication. Versus "Thrust us, we are going to do the right thing".
- saagarjha 2y ago
  Focusing on the language used to implement these is missing the forest for the trees
AceJohnny2 2y ago
You're assuming Microsoft acts as a singular, cohesive entity, which like any company it is not.
- gmd63 2y ago
  It's convenient for corporations to have this as an excuse, but they should be assessed as singular entities. They enjoy corporate personhood also. As the size and influence of an entity increases, it has more power in the economy and therefore should have more responsibility, not less, to act according to high standards. A gargantuan company that is 7% of the S&P 500 getting whoopsie-daisy passes because it is so large and nobody knows what it's doing is a dystopian situation that we should have incentives in place to discourage
- greenavocado 2y ago
  You're right. Carolina Hernandez speadheaded this initiative to take screenshots of your desktop every few seconds or minutes and transcribe the result into a regular local sqlite database.
godelski 2y ago
> What were the security problems? > They don't even allude to the existence or detection of any specific security problems Arguably the product itself. Which is another reason they might be vague about it. Because to talk about those security problems would taint the entire product and they can't do that if they aren't willing to completely scrap it. People have been talking about how the data in here is similar to what may be already existing but that's far from the truth. Yes, these companies have a lot of data on us, but this is a significant step forwards in the granularity of that data. It's also worth noting that hackers could not get into your computer and assume that your computer not only has a keylogger that they can access to further compromise your system (and other systems/accounts) but that they can also obtain screenshots. These increase user risk significantly and greatly reduce the requisite technical skill needed for those infiltrating machines. Similarly, many have pointed out the potential connections to Chat Control[0] and how such systems can likely be used by many companies to be exploitative of workers. While you may trust your company/partner/significant others/government and so on, it is important to remember that not everyone has such luxuries. It is also important to remember that such things can change. Even in the US there are high risks of potential abuse: such as police obtaining a warrant to get this data to see if someone is trying to obtain abortion medication. Regardless on where you fall on that specific issue, you can replace it with any other concerning issue and I'm sure you wouldn't like that (guns, religion, gender identity, political affiliations, and so on). So even if you trust Microsoft to not give away this type of information nor to provide authorities access (which often includes authorities not in your home country), then you must ask if the benefits are worth the costs. And not just for you, but for others.[1] > It sounds to me like they're figuring out a new marketing approach I suspect this is correct and as segasaturn suggested, turned up the heat too fast. I also suspect that this type of data invasion can be much more easily understood by the general public, who often struggle with understanding what metadata is and how it is/can be used. It does require technical knowledge for this and is often non-obvious, even for people who are well above average in technical literacy (as is the average HN user). [0] Specifically we should note here that Chat Control would force Microsoft to use this system in a much more invasive way. We lambasted Apple over their proposal for CSAM detection, including the potential risks of abuse even if it were theoretically impossible to avoid hash collisions. Having Relay would require Microsoft to implement such a system and that's why there are many conspiracies arising that Relay is specifically intended for Chat Control, because true or not it would likely have similar outcomes. We'll see if Apple revisits the idea, and the recent WWDC doesn't rule out such a possibility https://www.patrick-breyer.de/en/posts/chat-control/ https://www.patrick-breyer.de/en/posts/chat-control/ [1] https://www.youtube.com/watch?v=goQ4ii-zBMw https://www.youtube.com/watch?v=goQ4ii-zBMw
patmorgan23 2y ago
Per one of the ars Technica articles, All the information collected was stored locally completely unencrypted, and would be accessible by anyone with local administrator rights.
- slashdave 2y ago
  Nevermind accessible to other users, but accessible to any 3rd party application that the user executes. A nightmare of a security hole.
  - ranger_danger 2y ago
    That's already true for every desktop application though. All third party programs can spy on all other programs and documents that user has available. This has been a seemingly criminally-overlooked shortcoming of desktop systems and this approach has fallen WAY behind current mobile security practices.
    - shuckles 2y ago
      This is not true on macOS.
    - johnisgood 2y ago
      That is why "firejail" exists.
      - ranger_danger 2y ago
        The attack surface of firejail itself scares me enough to never use it.
        johnisgood 2y ago
        Care to elaborate?
- mihaaly 2y ago
HumblyTossed 2y ago
They're totally waiting for the negative press to die down, then they'll try again.
jmholla 2y ago
> It focuses on security, reiterates that security is their top priority (and we know that this is untrue). I think that messaging is a direct response to their hearing in from of the House yesterday. They were being grilled on their numerous security lapses and Brad Smith (president of Microsoft) constantly reiterated that they are refocusing their priorities to be security. They were also questioned about Recall specifically so it's not surprising to see this as one of the first places where they are putting out that messaging.
rvense 2y ago
Security is a mindset and some people don't have it. I used to work for a company that made a rather popular database for mobile applications. An easy API to store data on your phone and have it synced to a server with no effort on the developers part. Two of my co-workers spent a few weeks making a nice looking chat application which worked by syncing messages from many users to different devices, and they wanted to publish it as a demo. Until somebody else pointed out that there was no security at all. The server just accepts the latest state from the client. This was fine for most of the current use cases, but for chat basically meant that any client could rewrite the entire history and the server would just say "thanks!" on next sync and distribute the changes to everyone else. These were adult humans with degrees from respectable institutions, and this hadn't crossed their minds at all. Basically, I think a combination of Hanlon's razor and nobody wanting to be a naysayer is a perfectly adequate explanation for this Recall thing. I think it's obvious that a lot of people would like their computer to work like that, and I can see them wanting to get it out without having listened to any internal criticism (if they even have a culture that allows that).
ranger_danger 2y ago
> What were the security problems? I would argue there really weren't away, apart from the usual disaster/lack of security that desktop systems have. It wasn't uploaded anywhere, so the only threat would be from programs that would run locally and steal it, which is already the same for any other (even third-party) program stealing your local files, which they have always been able to do.
1vuio0pswjnm7 2y ago
"It sounds to me like they're figuring out a new marketing approach, or they're softening the blow by "listening to users" and then rolling out more slowly, when outrage has dies down ad people will just accept it." Of course "listening to users" really means "listening in on users". Or just "bad press". Microsoft does not consult with users before adding code into Windows. Nor do users contact Microsoft to tell the company what code they want or don't want. Even if they did, the company does not operate based on user suggestions. The reaction to "Recall" by journalists, bloggers and commenters is not that they think it should be "delayed". They think it is a bad idea. Microsoft will do as it pleases. As it always has done.
xnx 2y ago
People should not get over this (but probably will). There was an uproar (decades ago) about GMail "reading all your email". This was overblown, but Microsoft building the infrastructure to view a history of everything on your screen is much much worse. There's a lot more private things that get displayed on a screen (and of course all of your email would be a subset) that no one has a right to see.
mihaaly 2y ago
My recollection is that the CEO stated no security problem with the product, security was their utmost and first the toppest priority all the time and into eternity, they wouldn't dare trying to release anything with security concerns. Apparently there are security concerns afterall. Did they lie before or now or just completely clueless about what is a security concern or what? I am confused.
Jedd 2y ago
The specific security problem was that their enterprise customers said no, and not in a 'no thanks' way, but a more vehement 'no fucking way', way. They could conceivably push to SOHO users, but a) there's no revenue there (and this stuff is expensive), and b) it's really bad optics. "We're going to offer you a feature that your workplace refused to run on their network." I'm sure there's ways to spin that, but it'd be a challenge.

pcloadletter_ 2y ago

Or maybe they have to figure out how to actually make it work

deleted 2y ago
[deleted]

segasaturn 2y ago

My takeaway is that Microsoft has been trying to boil the frog, but slipped and turned the temperature up too quickly. They're retreating for now, but make no mistake that Recall will slowly trickle back into Windows under another name. Every major power broker wants something like Recall to become the norm - bosses to spy on their employees, governments to spy on their citizens/enemies, and tech CEO's to collect training data for AI and target more ads at end users.

ttyprintk 2y ago
I expect it to emerge as an accessibility feature for cognitive memory loss. Imagine not remembering the name of your email client or the color of its icon, but Siri With Screenshots can pull up an important email thread.
- vundercind 2y ago
  Christ. I just went through this stuff with a loved one, for a few years. “Hey Siri, what did mom do today?” “Asked 214 times when you were getting back in town, because she has not seen you in a long time.” “I’ve been back for two months and I saw her this morning.” “That is what I told her, each time.” “Ok. What else did she do?” “Nothing.” Yeesh. Some Black Mirror shit. [edit] not to crap on how nice that really might be for a lot of people. Dementia’s just… well, pretty messed up and sad, I guess, and bringing machines into the mix can be weird.
ugjka 2y ago
There are already Recall type of products on the market, not just that, they also work on the cloud not just locally. All Microsoft had to do was make it opt in by default
- bostik 2y ago
  Yes, these existing products are generally called RATs or spousal stalkerware.
  - ugjka 2y ago
    No
simonw 2y ago
This is a very cynical take. I've not seen anything to make me think this feature is intended for surveillance as opposed to personal utility. The personal utility benefits are very clear to me - the problem is the ease with which malicious attackers might steal the data (if they can breach the system).
- digging 2y ago
  > I've not seen anything to make me think this feature is intended for surveillance It's published by Microsoft
  - nonrandomstring 2y ago
    tbh that's a knockdown argument. All the conversation second guessing the intent and motives of bosses, users and third parties is moot when it runs on an OS that is controlled remotely and insecure by design. Apple are following, (and I exlect you'll have even less choice about that - because its clientsode scanning in disguise) and Google have always been proud of their surveillance based business model, so I think the whole landscape of big provider computing is changing. People are actually starting to question what they want computer devices for
- surfingdino 2y ago
  TPM was met with resistance due to privacy concerns and Microsoft quietly re-introduced it anyway. The same will happen to Recall.
  - brookst 2y ago
    Has TPM been a net positive or negative for users / enterprises / the industry?
    - ekidd 2y ago
      TPM protects against two main threat models: 1. You don't trust people with physical access to the computer. For the average home user, this means you consider the hardware owner a threat. 2. You want to protect against malware that has already taken complete control over the OS at runtime, and that wants to write itself to disk or the BIOS so that it survives a reboot. At this point, the attacker has already won, so... This might make sense on a stateless appliance like a Chromebook where you do factory wipes a lot. So TPM mostly "protects" against the hardware owner, or against malware that already has 100% access to all user data, and just wants to stick around a bit longer. Personally, I'd go with TPM being net negative, because the primary threat model it "protects" against is the actual hardware owner.
tivert 2y ago
> Every major power broker wants something like Recall to become the norm - bosses to spy on their employees... Isn't that already the norm, or at least very very common? It's just a 3rd party package totally focused on surveillance, not built into the OS and used for some user-accessible features. > ...governments to spy on their citizens/enemies, and tech CEO's to collect training data for AI and target more ads at end users. These applications would be novel, at least on a widespread basis in Western liberal democracies.
- segasaturn 2y ago
  >These applications would be novel, at least on a widespread basis in Western liberal democracies. How? We already know Google trains its AI on people's private emails and Five Eyes conducts mass surveillance on Western citizens (see: Snowden). You can be sure that the people behind the PRISM program are salivating at the thought of access to the unencrypted Recall databases, and that they'll be twisting Microsoft's arm for backdoor access.
  - tivert 2y ago
    >> These applications would be novel, at least on a widespread basis in Western liberal democracies. > How? We already know... I think you're making the mistake of interpreting this as a binary thing, which obscures the difference between, for instance, tapping phone calls and installing bugs in every room of everyone's home (a la 1984's telescreens). Or in this case, Google scanning the emails you sent/stored on their servers vs. Microsoft storing and scanning every action you take on your PC. It would be novel because most people outside a corporate environment don't have a keylogger/screen-recorder running on their system.
  - lrem 2y ago
    > We already know Google trains its AI on people's private emails Source?
Hasu 2y ago
> They're retreating for now, but make no mistake that Recall will slowly trickle back into Windows under another name. Not even that. It's still coming, under the same name, just not as soon for everyone.
golemotron 2y ago
I can't believe that no one there didn't anticipate the blowback. It could just have been a way for Satya to put the feature in front of their business customers. They'd likely want that feature even if consumers reject it.
albert_e 2y ago
Employers can collect task/business process staps by recording the screens. This will help train RPA bots and reduce the need for human workforce for repetitive tasks. Microsoft can collect this data across industries with or without informed consent and sell RPA/AI bots back to the same enterprise customers as a managed service. Lot of commercial potential there for the taking. Just needs a innocuous enough cover story ro make it a default offering to server you the individual customer alone and help you gain an edge over your peers.

swatcoder 2y ago

There's a much more mundane read: They invested a bunch of effort into a product the market loudly rejected. They're now withdrawing the product while they figure out what they can salvage from the effort. Key stakeholders may have a few ideas about how to proceed (ranging from "try again later" through "repurpose it" to "forget it"), but enterprises of Microsoft size make decisions very slowly so of course it's vague about what's next. Collectively, they almost certainly don't know!

consumer451 2y ago
In addition to direct market reaction, they must be a bit red in the face considering that Apple just laid out a complex and well thought out implementation of "AI", which focused on privacy. As someone who grew up near Redmond, who still has an emotional soft-spot for Microsoft for some reason, I feel truly embarrassed for their implementation.
- pjmlp 2y ago
  From all three major OS vendors on the consumer market, Microsoft is still the one that pushes more C and C++ into production on their OS, in detriment of .NET, despite all the security discussions. All the efforts from other teams to have .NET reach Swift, Java, Kotlin levels of adoption on Windows, have always hit a wall against WinDev culture. Also the 90's spirit from features over security hasn't yet gone away from WinDev, so it isn't really surprising this turned out this way.
  - consumer451 2y ago
    My personal feelings aside, Microsoft is Too Big to Suck like this, regarding security and privacy. At this point, their culture is a national security liability. We have seen some recent efforts, but how does one right such a large ship? https://www.theregister.com/2024/06/14/brad_smith_microsoft_hearing/ https://www.theregister.com/2024/06/14/brad_smith_microsoft_... https://www.theverge.com/2024/4/3/24119787/microsoft-cloud-email-hack-china-us-cyber-report https://www.theverge.com/2024/4/3/24119787/microsoft-cloud-e...

idkdotcom 2y ago

[dead]

deleted 2y ago

[deleted]

pjmlp 2y ago

Currently I am still looking forward to when the Secure Future Initiative (SFI) will actually mean more .NET and Rust and less COM and C++ love by Windows team. So until this changes, take with a grain of salt how much secure Recall is actually going to be. Contrast this with Apple Inteligence, where not only are most local APIs made available via Swift, they have created special hardware and a unikernel like OS with sandboxed layers, exposing only what OS capabilities required for AI processing and cluster communication. Versus "Thrust us, we are going to do the right thing".

saagarjha 2y ago
Focusing on the language used to implement these is missing the forest for the trees

AceJohnny2 2y ago

You're assuming Microsoft acts as a singular, cohesive entity, which like any company it is not.

gmd63 2y ago
It's convenient for corporations to have this as an excuse, but they should be assessed as singular entities. They enjoy corporate personhood also. As the size and influence of an entity increases, it has more power in the economy and therefore should have more responsibility, not less, to act according to high standards. A gargantuan company that is 7% of the S&P 500 getting whoopsie-daisy passes because it is so large and nobody knows what it's doing is a dystopian situation that we should have incentives in place to discourage
greenavocado 2y ago
You're right. Carolina Hernandez speadheaded this initiative to take screenshots of your desktop every few seconds or minutes and transcribe the result into a regular local sqlite database.

godelski 2y ago

> What were the security problems? > They don't even allude to the existence or detection of any specific security problems Arguably the product itself. Which is another reason they might be vague about it. Because to talk about those security problems would taint the entire product and they can't do that if they aren't willing to completely scrap it. People have been talking about how the data in here is similar to what may be already existing but that's far from the truth. Yes, these companies have a lot of data on us, but this is a significant step forwards in the granularity of that data. It's also worth noting that hackers could not get into your computer and assume that your computer not only has a keylogger that they can access to further compromise your system (and other systems/accounts) but that they can also obtain screenshots. These increase user risk significantly and greatly reduce the requisite technical skill needed for those infiltrating machines. Similarly, many have pointed out the potential connections to Chat Control[0] and how such systems can likely be used by many companies to be exploitative of workers. While you may trust your company/partner/significant others/government and so on, it is important to remember that not everyone has such luxuries. It is also important to remember that such things can change. Even in the US there are high risks of potential abuse: such as police obtaining a warrant to get this data to see if someone is trying to obtain abortion medication. Regardless on where you fall on that specific issue, you can replace it with any other concerning issue and I'm sure you wouldn't like that (guns, religion, gender identity, political affiliations, and so on). So even if you trust Microsoft to not give away this type of information nor to provide authorities access (which often includes authorities not in your home country), then you must ask if the benefits are worth the costs. And not just for you, but for others.[1] > It sounds to me like they're figuring out a new marketing approach I suspect this is correct and as segasaturn suggested, turned up the heat too fast. I also suspect that this type of data invasion can be much more easily understood by the general public, who often struggle with understanding what metadata is and how it is/can be used. It does require technical knowledge for this and is often non-obvious, even for people who are well above average in technical literacy (as is the average HN user). [0] Specifically we should note here that Chat Control would force Microsoft to use this system in a much more invasive way. We lambasted Apple over their proposal for CSAM detection, including the potential risks of abuse even if it were theoretically impossible to avoid hash collisions. Having Relay would require Microsoft to implement such a system and that's why there are many conspiracies arising that Relay is specifically intended for Chat Control, because true or not it would likely have similar outcomes. We'll see if Apple revisits the idea, and the recent WWDC doesn't rule out such a possibility https://www.patrick-breyer.de/en/posts/chat-control/ https://www.patrick-breyer.de/en/posts/chat-control/ [1] https://www.youtube.com/watch?v=goQ4ii-zBMw https://www.youtube.com/watch?v=goQ4ii-zBMw

patmorgan23 2y ago

Per one of the ars Technica articles, All the information collected was stored locally completely unencrypted, and would be accessible by anyone with local administrator rights.

slashdave 2y ago
Nevermind accessible to other users, but accessible to any 3rd party application that the user executes. A nightmare of a security hole.
- ranger_danger 2y ago
  That's already true for every desktop application though. All third party programs can spy on all other programs and documents that user has available. This has been a seemingly criminally-overlooked shortcoming of desktop systems and this approach has fallen WAY behind current mobile security practices.
  - shuckles 2y ago
    This is not true on macOS.
  - johnisgood 2y ago
    That is why "firejail" exists.
    - ranger_danger 2y ago
      The attack surface of firejail itself scares me enough to never use it.
      - johnisgood 2y ago
        Care to elaborate?
mihaaly 2y ago

HumblyTossed 2y ago

They're totally waiting for the negative press to die down, then they'll try again.

jmholla 2y ago

> It focuses on security, reiterates that security is their top priority (and we know that this is untrue). I think that messaging is a direct response to their hearing in from of the House yesterday. They were being grilled on their numerous security lapses and Brad Smith (president of Microsoft) constantly reiterated that they are refocusing their priorities to be security. They were also questioned about Recall specifically so it's not surprising to see this as one of the first places where they are putting out that messaging.

rvense 2y ago

Security is a mindset and some people don't have it. I used to work for a company that made a rather popular database for mobile applications. An easy API to store data on your phone and have it synced to a server with no effort on the developers part. Two of my co-workers spent a few weeks making a nice looking chat application which worked by syncing messages from many users to different devices, and they wanted to publish it as a demo. Until somebody else pointed out that there was no security at all. The server just accepts the latest state from the client. This was fine for most of the current use cases, but for chat basically meant that any client could rewrite the entire history and the server would just say "thanks!" on next sync and distribute the changes to everyone else. These were adult humans with degrees from respectable institutions, and this hadn't crossed their minds at all. Basically, I think a combination of Hanlon's razor and nobody wanting to be a naysayer is a perfectly adequate explanation for this Recall thing. I think it's obvious that a lot of people would like their computer to work like that, and I can see them wanting to get it out without having listened to any internal criticism (if they even have a culture that allows that).

ranger_danger 2y ago

> What were the security problems? I would argue there really weren't away, apart from the usual disaster/lack of security that desktop systems have. It wasn't uploaded anywhere, so the only threat would be from programs that would run locally and steal it, which is already the same for any other (even third-party) program stealing your local files, which they have always been able to do.

1vuio0pswjnm7 2y ago

"It sounds to me like they're figuring out a new marketing approach, or they're softening the blow by "listening to users" and then rolling out more slowly, when outrage has dies down ad people will just accept it." Of course "listening to users" really means "listening in on users". Or just "bad press". Microsoft does not consult with users before adding code into Windows. Nor do users contact Microsoft to tell the company what code they want or don't want. Even if they did, the company does not operate based on user suggestions. The reaction to "Recall" by journalists, bloggers and commenters is not that they think it should be "delayed". They think it is a bad idea. Microsoft will do as it pleases. As it always has done.

xnx 2y ago

People should not get over this (but probably will). There was an uproar (decades ago) about GMail "reading all your email". This was overblown, but Microsoft building the infrastructure to view a history of everything on your screen is much much worse. There's a lot more private things that get displayed on a screen (and of course all of your email would be a subset) that no one has a right to see.

mihaaly 2y ago

My recollection is that the CEO stated no security problem with the product, security was their utmost and first the toppest priority all the time and into eternity, they wouldn't dare trying to release anything with security concerns. Apparently there are security concerns afterall. Did they lie before or now or just completely clueless about what is a security concern or what? I am confused.

Jedd 2y ago

The specific security problem was that their enterprise customers said no, and not in a 'no thanks' way, but a more vehement 'no fucking way', way. They could conceivably push to SOHO users, but a) there's no revenue there (and this stuff is expensive), and b) it's really bad optics. "We're going to offer you a feature that your workplace refused to run on their network." I'm sure there's ways to spin that, but it'd be a challenge.