3 ms·

I'm curious about the last paragraph relating to Signal. How, exactly, have Brave managed this without also blocking screenshots? Is there a flag Signal missed?

Svip 1y ago
According to the same paragraph, it's because Signal isn't a "browser app": > Given that Windows doesn’t let non-browser apps granularly disable Recall, Signal cleverly uses the DRM flag on their app to disable all screenshots. (emphasis mine) Apparently, Microsoft consider browsers special: > While it’s heartening that Microsoft recognizes that Web browsers are especially privacy-sensitive applications, we hope they offer the same granular ability to turn off Recall to all privacy-minded application developers.
- jadamson 1y ago
  Oops. Yeah, I shouldn't have missed that. Still, does this mean Microsoft maintains an approved browser list for this? Would the various other less-known Chromium/Firefox forks be unable to take advantage of the same thing? Edit: https://learn.microsoft.com/en-us/windows/ai/recall/recall-web-browsers https://learn.microsoft.com/en-us/windows/ai/recall/recall-w... > To make sure that Recall doesn't save your user's browsing history while in modes like this, your app can use the SetInputScope function, setting the input scope to IS_PASSWORD. > Your app must also have a http or https protocol handler registered before SetInputScope will support the behavior described in this article. I now wonder if you can register a handler that never gets used since you won't be the default browser (and if you do end up as the default somehow, warn the user when called).
robin_reala 1y ago
Microsoft specifically allows software in the category “browsers” to disable Recall.
- eviks 1y ago
  How is this category defined? Can an app resister itself as a browser?
- aleph_minus_one 1y ago
  > Microsoft specifically allows software in the category “browsers” to disable Recall. 1. "Browser" does not mean "web browser": many kinds of applications can be considered a browser. 2. Even if you identify "browser" with "web browser": Electron apps are basically (web) browsers (though not fully functional ones). Nobody claimed said for a software to be in the "browser" category, it has to be a fully functional web browser.
  - dotancohen 1y ago
    How does the OS know that foobar application is a [[fully functional] web] browser?
    - delfinom 1y ago
      It doesn't. Windows is just checking if there's a protocol handler entry in the registry for http/https. In theory you don't abuse that because it will come up as a possible browser option for users. :shrug:
skaul 1y ago
(disclaimer: I lead privacy at Brave and wrote the article) Windows lets browser apps (more technically, apps that have an `http` or `https` protocol handler registered) to use `SetInputScope` function to set `IS_PRIVATE` for a window. We were able to use that and have it apply for all Brave windows, and thus granularly turn off Recall without affecting non-Recall screen readers or screenshot capabilities. Signal doesn't have protocol handlers for `http` and `https`, so it can't do the same.

Svip 1y ago

According to the same paragraph, it's because Signal isn't a "browser app": > Given that Windows doesn’t let non-browser apps granularly disable Recall, Signal cleverly uses the DRM flag on their app to disable all screenshots. (emphasis mine) Apparently, Microsoft consider browsers special: > While it’s heartening that Microsoft recognizes that Web browsers are especially privacy-sensitive applications, we hope they offer the same granular ability to turn off Recall to all privacy-minded application developers.

jadamson 1y ago
Oops. Yeah, I shouldn't have missed that. Still, does this mean Microsoft maintains an approved browser list for this? Would the various other less-known Chromium/Firefox forks be unable to take advantage of the same thing? Edit: https://learn.microsoft.com/en-us/windows/ai/recall/recall-web-browsers https://learn.microsoft.com/en-us/windows/ai/recall/recall-w... > To make sure that Recall doesn't save your user's browsing history while in modes like this, your app can use the SetInputScope function, setting the input scope to IS_PASSWORD. > Your app must also have a http or https protocol handler registered before SetInputScope will support the behavior described in this article. I now wonder if you can register a handler that never gets used since you won't be the default browser (and if you do end up as the default somehow, warn the user when called).

robin_reala 1y ago

Microsoft specifically allows software in the category “browsers” to disable Recall.

eviks 1y ago
How is this category defined? Can an app resister itself as a browser?
aleph_minus_one 1y ago
> Microsoft specifically allows software in the category “browsers” to disable Recall. 1. "Browser" does not mean "web browser": many kinds of applications can be considered a browser. 2. Even if you identify "browser" with "web browser": Electron apps are basically (web) browsers (though not fully functional ones). Nobody claimed said for a software to be in the "browser" category, it has to be a fully functional web browser.
- dotancohen 1y ago
  How does the OS know that foobar application is a [[fully functional] web] browser?
  - delfinom 1y ago
    It doesn't. Windows is just checking if there's a protocol handler entry in the registry for http/https. In theory you don't abuse that because it will come up as a possible browser option for users. :shrug:

skaul 1y ago

(disclaimer: I lead privacy at Brave and wrote the article) Windows lets browser apps (more technically, apps that have an `http` or `https` protocol handler registered) to use `SetInputScope` function to set `IS_PRIVATE` for a window. We were able to use that and have it apply for all Brave windows, and thus granularly turn off Recall without affecting non-Recall screen readers or screenshot capabilities. Signal doesn't have protocol handlers for `http` and `https`, so it can't do the same.