3 ms·
Signal to Windows Recall: Drop Dead
- LorenDB 1y agoPrevious discussion of same topic: https://news.ycombinator.com/item?id=44053364 https://news.ycombinator.com/item?id=44053364
- yupyupyups 1y agoIn short: Signal uses DRM to prevent Windows Recall (spyware) from capturing what's inside the app. It's similar to how Netflix prevents piracy. That's an interesting use-case of web DRM. There are other details in the article, for example about Recall forces users to use biometrics to then permit them to authenticate using a PIN code. That's an interesting observation.
- mmozeiko 1y agoI don't know why Signal calls it "DRM" because the do not use DRM for this. Typically DRM means encryption & keys are involved (which is what Netflix & others are doing with Widevine or PlayReady). All Signal does is just a simple Windows API call to exclude window from screen capture. SetWindowDisplayAffinity function with WDA_EXCLUDEFROMCAPTURE argument: https://learn.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-setwindowdisplayaffinity https://learn.microsoft.com/en-us/windows/win32/api/winuser/...
- yupyupyups 1y agoThanks for the insight, I thought they took advantage of the whole DRM stack (including HDCP in monitors) to encrypt the UI and let the monitor decrypt it.
- k_roy 1y agoAnd Microsoft, literally call it the DRM flag. DRM doesn't insist on being encrypted. https://learn.microsoft.com/en-us/windows/client-management/manage-recall https://learn.microsoft.com/en-us/windows/client-management/... And that "simple Windows API" call is pretty much absolute, since it's across the stack.
- deleted 1y ago[deleted]
- compsciphd 1y agoand as plenty of people have noted, virtue signaling. As signal already saves one's entire chat history by default in an easily digestible db. any security hole on windows that enables an attacker to get to the recall db, would just as easily enable them to get to the signal db.