9 ms·

But it’s literally the dumbest feature ever. There’s absolutely nothing preventing a user from pulling out their phone and taking a picture of any slide they w

by tw04 1y ago

But it’s literally the dumbest feature ever. There’s absolutely nothing preventing a user from pulling out their phone and taking a picture of any slide they want. Or having a camera recording the whole session out of view of their webcam. It is security theater at its peak.

tmpz22 1y ago
In a 1:1 format this would be effective in preventing some forms of misuse because it would be obvious if an individual took out their phone and pointed it towards the screen.
- relwin 1y ago
  Easily circumvented: Use two monitors, one positioned out of view. Use a teleprompter mirror with a camera behind the mirror. Use a video capture device, record on a separate computer. I'm sure there's sneakier ways to perform this...
  - josephg 1y ago
    Your “easy” circumvention requires a second monitor, a teleprompter mirror, a camera, a separate computer and a video capture device. Remember, most people who use Teams don't work in tech. And for them, that’s not “easy”. Barely any normal people have that kind of equipment just lying around, along with the expertise and desire to set all that up, ready for a teams meeting. For every 100 people who might decide to take a screenshot during a teams meeting, I doubt there’s 1 person who has all that equipment set up and ready to go. You don’t need to make something 100% effective to get a benefit from doing so.
  - ThrowawayR2 1y ago
    These comments are akin to pointing out that the privacy door on a public bathroom stall can easily be bypassed by looking over the top of the stall walls or underneath the gap between the ground and the bottom of the wall. In their rush to be clever, they instead demonstrate that the poster completely missed the point.
  - deleted 1y ago
    [deleted]
- antihipocrat 1y ago
  You turn your camera off for 10 seconds, take the photo and turn the camera back on. No-one would notice a thing If you wanted video just have the device positioned outside the field of view. Laptop cameras fov is very narrow.
- kaonwarb 1y ago
  Sibling comment's definition of "easily" varies materially from my own!
- mastazi 1y ago
  but it is so easy to circumvent, even my teenage daughter, who doesn't have an interest in tech, knows what a capture card is and knows what an hdmi splitter is: she hasn't even entered the workforce yet and she already has all the ingredients needed to circumvent a software block on screenshots :-D
lolinder 1y ago
It's not pure security theater, there are a few clear gains for those who care about such things: * Naive screencaps are much less traceable to the leaker than a naive photo is. Yes, someone can strip out EXIF data, but we've seen over and over again that they generally don't. And even without EXIF a naive framing on the photo is more likely to expose information about the location or identity of the person who took it. * A photo of a webinar is going to (barring serious postprocessing) look much less official and be less legible than a screenshot, so the use cases for illicit captures are going to be fewer. Few people are going to try to take a phone photo of the top-secret meeting and use the slide in their next team all-hands, but many might forget the rules and than snap a screenshot really quickly for later use. * Just having the ability to block the easy method of screen captures helps avoid cases where the person doing the capturing isn't actively malicious, just ill-informed. If a normal employee attempts a screenshot and is reminded they're not supposed to do that, they're not going to pull out their phone to take a photo, they're going to say "oops" and move on. Yeah, there are threat models that won't be stopped here, but most of corporate InfoSec is wrapped up in protecting against pretty lame threat models that would benefit from this—mostly uninformed/ignorant employees screwing up without intending to be a threat.
- cma 1y ago
  > Yeah, there are threat models that won't be stopped here Like running windows in a VM or using an HDMI capture card. And are they going to break running teams meetings when using moonlight etc. with this? If you are OBS capturing during the meeting does it get blacked out or just breaks your recording?
  - lolinder 1y ago
    You don't need to elaborate on mechanisms for bypassing because you're already imagining a threat actor that is out of scope. This is primarily about blocking accidental leaks by regular employees who were asked to not record but ignored it. This kind of reuse of content happens all the time in companies of any significant size and isn't entirely stopped by simple requests or watermarks. This tool gives companies one more option to protect against this very lame and boring but also very real threat.
smelendez 1y ago
I’ve been on calls where a presenter explicitly asks that people not screenshot slides shown in the meeting because they’re drafts that will be refined and published or circulated later on. Some companies probably have that as a blanket policy. I’m sure this isn’t universally followed. This feature would help make that less likely to happen accidentally or “accidentally.” It wouldn’t stop deliberate leaks but that’s a different problem.
- Aurornis 1y ago
  We once had an intern who took screenshots of an internal presentation and posted them on the internet to brag about how cool his internship was. When we did his exit interview he admitted he just wasn’t thinking. He did it all in a couple minutes while in the meeting. Something like this would have stopped him in the process and made him remember that the content was sensitive. Don’t underestimate the diversity of the people watching zoom meetings. It’s not all engineers with elaborate screen capture setups prepared for the express purpose of recording meetings.
  - SirMaster 1y ago
    Seems like you will now have 1 less way to weed out an employee you don't want... If someone was going to do something dumb like that I wouldn't want them to keep their job now instead simply because the software prevented them from doing something so dumb or dangerous.
    - bolognafairy 1y ago
      Thank you Hacker News commenter for lecturing someone on Human Resources policy. The ultimate scope creep from someone explaining why this feature might have an iota of value. The SECOND a tool that you use add a feature that you want because “um, we don’t think that your business should work like that, actually”, there’d be an angry rant on the front page of this very site.
  - MattPalmer1086 1y ago
    Yes, this is a great example of why a control like this is useful. People do dumb things. The fact that it won't prevent a determined attacker isn't the point.
Aeolun 1y ago
That’s because what the users want isn’t actually being secure. They want to be able to say they did everything in their power to stop people from capturing sensitive info. It’s all about diffusing that responsibility.
- stevage 1y ago
  It reduces the risk, it doesn't completely eliminate it, and that's fine. Not everything was to be 100%.
  - Aeolun 1y ago
    I think I’m just fundamentally against any corporate functionality that reduces the employees to grade schoolers.
stevage 1y ago
Nah, this would stop a lot of threats. I'm an example of that threat. I'm a freelancer who often has video calls with new clients. Sometimes I surreptitiously screen cap demos or presentations. It would be very difficult to use a phone that way without breaking the conversational flow. Other supposed workarounds would require much more preplanning. Like I'd need to know that there was something worth capturing.
- realitysballs 1y ago
  RDP into computer that has meeting running and then screenshot from the external computer running RDP .
  - stevage 1y ago
    Yep, I already covered workarounds that would be possible with preplanning.
    - Dylan16807 1y ago
      If you already do it regularly, then the preplanning is not a big barrier. You already know that you keep getting into situations where something is worth capturing. HDMI capture with passthrough is $20.
      - bolognafairy 1y ago
        Are you genuinely not reading the comments that you’re replying to? OP did mot solicit or show that there would be any value in people listing ways that one could circumvent this with preparation. We all know. You aren’t adding anything to the discussion. Nerds love ignoring the cost of human effort if it gives them an opportunity to show that they know something.
        Dylan16807 1y ago
        I'm definitely reading the comments. I'm replying to a very specific comment that made a very specific argument. There are lots of arguments I find convincing for this being effective. But not OP's. OP is saying they already do these recordings regularly, but "preplanning" would stop them? No way. They already did all the necessary preplanning by the time they finished typing their comment. Preplanning could be meaningful for other people, but not for them and people like them. I only mentioned price to make it clear that the level of effort to make the purchase falls within the level of effort they have already established.
9cb14c1ec0 1y ago
Or use an hdmi capture card.
lokar 1y ago
Nothing, /yet/
jasonfarnon 1y ago
just because it isn't perfect doesnt mean it's "dumbest". snapchat, 4chan, etc. will foil 99% of users, who don't think to take/are incapable of taking that next step.
voidspark 1y ago
It helps to prevent accidental sharing of confidential information.
miki123211 1y ago
There are two kinds of people in the world, those who completely misunderstand the value of friction, and those who depend on friction too heavily; GP clearly falls into the former group. This feature provides value because it increases friction. It won't stop really determined and motivated users from leaking, but it'll make leaks, especially accidental leaks / those due to hacks, a lot less common. The same applies to DRM, "security by obscurity", social media post editing / deletion, dark patterns, loss leaders, promotions and coupons, the list is endless. If your user is a perfectly rational being with infinite time and infinite tech savviness, the proverbial "spherical cow", those features make 0 sense. Just like spherical cows, though, those users don't actually exist, and so friction matters. That doesn't mean friction is infinite, though. It's too easy to overestimate it and fall into the trap of thinking that "users won't bother doing this, it doesn't matter if this combination of actions loses us money, it's too bothersome", and then get very surprised very quickly.
- tw04 1y ago
  I work in security. I have had customers request this feature. I have asked them to do an anonymous survey of users to ask what action they would take if they were blocked from taking screenshots and users universally say they’d take a picture of their screen with their phone. I don’t underestimate friction, I just know even my grandma would reach for her camera for a picture of her screen and she doesn’t even know what a screen capture is. It’s a stupid feature that doesn’t create friction, it just encourages users to take an untraceable action. I would FAR prefer recording who took a screenshot than blocking it as a presenter.
  - zmgsabst 1y ago
    Also, the screenshot stays within your corporate network, whereas the photo is immediately backed up to iCloud, sent over messenger, etc. The friction pushes the flow into something even worse — while not actually changing the behavior.
  - Aurornis 1y ago
    > I have asked them to do an anonymous survey of users to ask what action they would take if they were blocked from taking screenshots and users universally say they’d take a picture of their screen with their phone. Everyone knows this. You don’t need this survey (which surely was a real thing that actually occurred and not something you just conveniently imagined for this argument, right?) to tell you that. It’s literally written in the linked article. We know. There are ways around it. But it’s friction, and friction has value. People know it’s not perfect, but it’s another reminder that people aren’t supposed to be doing it.
Aurornis 1y ago
I think it’s funny that so many of these comments assume the person clicking the “enable screenshot protection” checkbox will be unaware that participants might have camera phones. It’s equally funny to read the comments imagining participants with elaborate pre-built workarounds like hidden pinhole cameras or pre-configured HDMI splitters going into full-screen video capture on another system. The people using this feature aren’t going to imagine it as 100% protective against any and all possible methods of exfiltrating data. It’s a feature for discouraging casual data capture and dissemination. It serves to remind people doing spontaneous captures that they aren’t supposed to, but everyone knows a dedicated person could find a way to get that photo if they really, really want. That doesn’t make it useless. Every time you raise the level of difficulty for accomplishing something, a percentage of attempts are thwarted or discouraged. As it turns out in the real world, raising the bar even a little tiny bit is effective in thwarting or discouraging the majority of attempts across the average user base. You’re not defeating the dedicated attackers, but you’re reducing the overall number of successful attacks and even attempts. The same is true for things like the office firewall blocking websites: Yes, we all know a dedicated engineer can create a way around it, but it’s going to stop most employees from getting to those sites and serve as a reminder to others that they’re not supposed to access them.
- avs733 1y ago
  The funniest part to me is these comments exclude something even more basic: joining a teams meeting on your phone. Notice the platforms mentioned ITA? I regularly, as do many of the people here, join meetings from my phone. I often do so so I can squeeze a run in. I especially do so in the types of all hands or large meetings where I’m in listen only mode and things are shared that would be hard to trace back to any individual in the room. I’m not carrying a second phone to take a picture of a slide - but I regularly take screenshots in those meetings to remind myself of something or to show someone when bitching. The relevant xkcd here is decryption by wrench (538) - the problem being solved is not battling 1337 hackers, it’s herding normally distributed loan officers at a mid regional bank.
  - hulitu 1y ago
    > joining a teams meeting on your phone I am not so masochistic.
luke727 1y ago
> But it’s literally the dumbest feature ever. My company recently configured Slack for mobile to disallow copying text.
- djmips 1y ago
  That's frustrating. Can you can still, if you have Android, use the text capture feature built in that reads text from bitmaps? I use that everyday for sites and apps that don't allow copy paste.
  - luke727 1y ago
    This was part of a larger security policy change that also dropped support for my phone manufacturer so I couldn't say.
- guappa 1y ago
  I use localslackirc. It logs deletions as well.
bolognafairy 1y ago
Please stop moving the goalposts. It makes it even more blatant that you’re engaging in a kneejerk emotional argument that doesn’t belong on this website.
trav4225 1y ago
But just wait until all consumer image display and capture devices start using invisible-to-the-naked-eye watermarking and content protection, only allowing you to photograph sources which have explicitly granted permission to be photographed. :-)
lern_too_spel 1y ago
It prevents some accidental recording, which has value.

by tw04 1y ago

tmpz22 1y ago

In a 1:1 format this would be effective in preventing some forms of misuse because it would be obvious if an individual took out their phone and pointed it towards the screen.

relwin 1y ago
Easily circumvented: Use two monitors, one positioned out of view. Use a teleprompter mirror with a camera behind the mirror. Use a video capture device, record on a separate computer. I'm sure there's sneakier ways to perform this...
- josephg 1y ago
  Your “easy” circumvention requires a second monitor, a teleprompter mirror, a camera, a separate computer and a video capture device. Remember, most people who use Teams don't work in tech. And for them, that’s not “easy”. Barely any normal people have that kind of equipment just lying around, along with the expertise and desire to set all that up, ready for a teams meeting. For every 100 people who might decide to take a screenshot during a teams meeting, I doubt there’s 1 person who has all that equipment set up and ready to go. You don’t need to make something 100% effective to get a benefit from doing so.
- ThrowawayR2 1y ago
  These comments are akin to pointing out that the privacy door on a public bathroom stall can easily be bypassed by looking over the top of the stall walls or underneath the gap between the ground and the bottom of the wall. In their rush to be clever, they instead demonstrate that the poster completely missed the point.
- deleted 1y ago
  [deleted]
antihipocrat 1y ago
You turn your camera off for 10 seconds, take the photo and turn the camera back on. No-one would notice a thing If you wanted video just have the device positioned outside the field of view. Laptop cameras fov is very narrow.
kaonwarb 1y ago
Sibling comment's definition of "easily" varies materially from my own!
mastazi 1y ago
but it is so easy to circumvent, even my teenage daughter, who doesn't have an interest in tech, knows what a capture card is and knows what an hdmi splitter is: she hasn't even entered the workforce yet and she already has all the ingredients needed to circumvent a software block on screenshots :-D

lolinder 1y ago

It's not pure security theater, there are a few clear gains for those who care about such things: * Naive screencaps are much less traceable to the leaker than a naive photo is. Yes, someone can strip out EXIF data, but we've seen over and over again that they generally don't. And even without EXIF a naive framing on the photo is more likely to expose information about the location or identity of the person who took it. * A photo of a webinar is going to (barring serious postprocessing) look much less official and be less legible than a screenshot, so the use cases for illicit captures are going to be fewer. Few people are going to try to take a phone photo of the top-secret meeting and use the slide in their next team all-hands, but many might forget the rules and than snap a screenshot really quickly for later use. * Just having the ability to block the easy method of screen captures helps avoid cases where the person doing the capturing isn't actively malicious, just ill-informed. If a normal employee attempts a screenshot and is reminded they're not supposed to do that, they're not going to pull out their phone to take a photo, they're going to say "oops" and move on. Yeah, there are threat models that won't be stopped here, but most of corporate InfoSec is wrapped up in protecting against pretty lame threat models that would benefit from this—mostly uninformed/ignorant employees screwing up without intending to be a threat.

cma 1y ago
> Yeah, there are threat models that won't be stopped here Like running windows in a VM or using an HDMI capture card. And are they going to break running teams meetings when using moonlight etc. with this? If you are OBS capturing during the meeting does it get blacked out or just breaks your recording?
- lolinder 1y ago
  You don't need to elaborate on mechanisms for bypassing because you're already imagining a threat actor that is out of scope. This is primarily about blocking accidental leaks by regular employees who were asked to not record but ignored it. This kind of reuse of content happens all the time in companies of any significant size and isn't entirely stopped by simple requests or watermarks. This tool gives companies one more option to protect against this very lame and boring but also very real threat.

smelendez 1y ago

I’ve been on calls where a presenter explicitly asks that people not screenshot slides shown in the meeting because they’re drafts that will be refined and published or circulated later on. Some companies probably have that as a blanket policy. I’m sure this isn’t universally followed. This feature would help make that less likely to happen accidentally or “accidentally.” It wouldn’t stop deliberate leaks but that’s a different problem.

Aurornis 1y ago
We once had an intern who took screenshots of an internal presentation and posted them on the internet to brag about how cool his internship was. When we did his exit interview he admitted he just wasn’t thinking. He did it all in a couple minutes while in the meeting. Something like this would have stopped him in the process and made him remember that the content was sensitive. Don’t underestimate the diversity of the people watching zoom meetings. It’s not all engineers with elaborate screen capture setups prepared for the express purpose of recording meetings.
- SirMaster 1y ago
  Seems like you will now have 1 less way to weed out an employee you don't want... If someone was going to do something dumb like that I wouldn't want them to keep their job now instead simply because the software prevented them from doing something so dumb or dangerous.
  - bolognafairy 1y ago
    Thank you Hacker News commenter for lecturing someone on Human Resources policy. The ultimate scope creep from someone explaining why this feature might have an iota of value. The SECOND a tool that you use add a feature that you want because “um, we don’t think that your business should work like that, actually”, there’d be an angry rant on the front page of this very site.
- MattPalmer1086 1y ago
  Yes, this is a great example of why a control like this is useful. People do dumb things. The fact that it won't prevent a determined attacker isn't the point.

Aeolun 1y ago

That’s because what the users want isn’t actually being secure. They want to be able to say they did everything in their power to stop people from capturing sensitive info. It’s all about diffusing that responsibility.

stevage 1y ago
It reduces the risk, it doesn't completely eliminate it, and that's fine. Not everything was to be 100%.
- Aeolun 1y ago
  I think I’m just fundamentally against any corporate functionality that reduces the employees to grade schoolers.

stevage 1y ago

Nah, this would stop a lot of threats. I'm an example of that threat. I'm a freelancer who often has video calls with new clients. Sometimes I surreptitiously screen cap demos or presentations. It would be very difficult to use a phone that way without breaking the conversational flow. Other supposed workarounds would require much more preplanning. Like I'd need to know that there was something worth capturing.

realitysballs 1y ago
RDP into computer that has meeting running and then screenshot from the external computer running RDP .
- stevage 1y ago
  Yep, I already covered workarounds that would be possible with preplanning.
  - Dylan16807 1y ago
    If you already do it regularly, then the preplanning is not a big barrier. You already know that you keep getting into situations where something is worth capturing. HDMI capture with passthrough is $20.
    - bolognafairy 1y ago
      Are you genuinely not reading the comments that you’re replying to? OP did mot solicit or show that there would be any value in people listing ways that one could circumvent this with preparation. We all know. You aren’t adding anything to the discussion. Nerds love ignoring the cost of human effort if it gives them an opportunity to show that they know something.
      - Dylan16807 1y ago
        I'm definitely reading the comments. I'm replying to a very specific comment that made a very specific argument. There are lots of arguments I find convincing for this being effective. But not OP's. OP is saying they already do these recordings regularly, but "preplanning" would stop them? No way. They already did all the necessary preplanning by the time they finished typing their comment. Preplanning could be meaningful for other people, but not for them and people like them. I only mentioned price to make it clear that the level of effort to make the purchase falls within the level of effort they have already established.

9cb14c1ec0 1y ago

Or use an hdmi capture card.

lokar 1y ago

Nothing, /yet/

jasonfarnon 1y ago

just because it isn't perfect doesnt mean it's "dumbest". snapchat, 4chan, etc. will foil 99% of users, who don't think to take/are incapable of taking that next step.

voidspark 1y ago

It helps to prevent accidental sharing of confidential information.

miki123211 1y ago

There are two kinds of people in the world, those who completely misunderstand the value of friction, and those who depend on friction too heavily; GP clearly falls into the former group. This feature provides value because it increases friction. It won't stop really determined and motivated users from leaking, but it'll make leaks, especially accidental leaks / those due to hacks, a lot less common. The same applies to DRM, "security by obscurity", social media post editing / deletion, dark patterns, loss leaders, promotions and coupons, the list is endless. If your user is a perfectly rational being with infinite time and infinite tech savviness, the proverbial "spherical cow", those features make 0 sense. Just like spherical cows, though, those users don't actually exist, and so friction matters. That doesn't mean friction is infinite, though. It's too easy to overestimate it and fall into the trap of thinking that "users won't bother doing this, it doesn't matter if this combination of actions loses us money, it's too bothersome", and then get very surprised very quickly.

tw04 1y ago
I work in security. I have had customers request this feature. I have asked them to do an anonymous survey of users to ask what action they would take if they were blocked from taking screenshots and users universally say they’d take a picture of their screen with their phone. I don’t underestimate friction, I just know even my grandma would reach for her camera for a picture of her screen and she doesn’t even know what a screen capture is. It’s a stupid feature that doesn’t create friction, it just encourages users to take an untraceable action. I would FAR prefer recording who took a screenshot than blocking it as a presenter.
- zmgsabst 1y ago
  Also, the screenshot stays within your corporate network, whereas the photo is immediately backed up to iCloud, sent over messenger, etc. The friction pushes the flow into something even worse — while not actually changing the behavior.
- Aurornis 1y ago
  > I have asked them to do an anonymous survey of users to ask what action they would take if they were blocked from taking screenshots and users universally say they’d take a picture of their screen with their phone. Everyone knows this. You don’t need this survey (which surely was a real thing that actually occurred and not something you just conveniently imagined for this argument, right?) to tell you that. It’s literally written in the linked article. We know. There are ways around it. But it’s friction, and friction has value. People know it’s not perfect, but it’s another reminder that people aren’t supposed to be doing it.

Aurornis 1y ago

I think it’s funny that so many of these comments assume the person clicking the “enable screenshot protection” checkbox will be unaware that participants might have camera phones. It’s equally funny to read the comments imagining participants with elaborate pre-built workarounds like hidden pinhole cameras or pre-configured HDMI splitters going into full-screen video capture on another system. The people using this feature aren’t going to imagine it as 100% protective against any and all possible methods of exfiltrating data. It’s a feature for discouraging casual data capture and dissemination. It serves to remind people doing spontaneous captures that they aren’t supposed to, but everyone knows a dedicated person could find a way to get that photo if they really, really want. That doesn’t make it useless. Every time you raise the level of difficulty for accomplishing something, a percentage of attempts are thwarted or discouraged. As it turns out in the real world, raising the bar even a little tiny bit is effective in thwarting or discouraging the majority of attempts across the average user base. You’re not defeating the dedicated attackers, but you’re reducing the overall number of successful attacks and even attempts. The same is true for things like the office firewall blocking websites: Yes, we all know a dedicated engineer can create a way around it, but it’s going to stop most employees from getting to those sites and serve as a reminder to others that they’re not supposed to access them.

avs733 1y ago
The funniest part to me is these comments exclude something even more basic: joining a teams meeting on your phone. Notice the platforms mentioned ITA? I regularly, as do many of the people here, join meetings from my phone. I often do so so I can squeeze a run in. I especially do so in the types of all hands or large meetings where I’m in listen only mode and things are shared that would be hard to trace back to any individual in the room. I’m not carrying a second phone to take a picture of a slide - but I regularly take screenshots in those meetings to remind myself of something or to show someone when bitching. The relevant xkcd here is decryption by wrench (538) - the problem being solved is not battling 1337 hackers, it’s herding normally distributed loan officers at a mid regional bank.
- hulitu 1y ago
  > joining a teams meeting on your phone I am not so masochistic.

luke727 1y ago

> But it’s literally the dumbest feature ever. My company recently configured Slack for mobile to disallow copying text.

djmips 1y ago
That's frustrating. Can you can still, if you have Android, use the text capture feature built in that reads text from bitmaps? I use that everyday for sites and apps that don't allow copy paste.
- luke727 1y ago
  This was part of a larger security policy change that also dropped support for my phone manufacturer so I couldn't say.
guappa 1y ago
I use localslackirc. It logs deletions as well.

bolognafairy 1y ago

Please stop moving the goalposts. It makes it even more blatant that you’re engaging in a kneejerk emotional argument that doesn’t belong on this website.

trav4225 1y ago

But just wait until all consumer image display and capture devices start using invisible-to-the-naked-eye watermarking and content protection, only allowing you to photograph sources which have explicitly granted permission to be photographed. :-)

lern_too_spel 1y ago

It prevents some accidental recording, which has value.