4 ms·

When I was working in audits, I used to record everything happening on my screen with 3 fps and then rewatching it with 10x speed, just not to forget anything.

When I was working in audits, I used to record everything happening on my screen with 3 fps and then rewatching it with 10x speed, just not to forget anything. When Recall was announced, I was in minority who thought it was super cool technology.

XorNot 1y ago
There's nothing wrong with the concept, but if it's not local with you in total control of the data then it's also just a no go.
noir_lord 1y ago
> I was in minority who thought it was super cool technology. The technology can be cool while still be a horrific idea because of the implementation and privacy implications.
- compsciphd 1y ago
  the privacy implications are really no worse than people who have a web browser cache/history, use a password manager, and have their entire email/message history available for offline perusal on their computer/device. just like an attacker can go after the recall data, they can go after those well known sources of data as well, which are generally not encrypted. Which is why, for example, the changes signal made to prevent recall from working when it was visible, were pure virtue signalling. By default signal on the PC keeps all messages sent available in a db that any attacker can easily download. The entire criticism aimed at recall ignored all the other ways this data is stored on one's PC.
- meowface 1y ago
  As long as it's stored and processed locally, I don't really see the implications being that much worse than someone getting all your local IRC/IM/email logs. (Those or their equivalents are stored in the cloud nowadays but disregard that for now for the sake of argument.)
  - mschuster91 1y ago
    > As long as it's stored and processed locally Anything stored locally can be exfiltrated by malware. Run OCR on the archives, check when someone opens their password manager, copy and exfiltrate the password. Oh and partners, ex-partners and children can also abuse such data. Even if you clear your browsing history, forget about clearing the Recall cache and whoops, they can see your browsing habits post-facto. Employers and law enforcement agencies are another bad actor that's to guard against. Even if laws such as GDPR or employee safety regulations prohibit companies from screenrecording, there's not much stopping them from using a feature Microsoft tries its hardest to prevent people from opting out of.
  - 63stack 1y ago
    It has been over a decade that big tech has been playing this script: * Introduce a feature that is abysmal for user privacy * Promise it's okay because $reasons * Make the feature opt-out * Change the EULA so that $reasons are no longer applicable/valid * Roll out an update that "accidentally" turns the feature back on for everyone * Apologize, deny, divert, deflect * Siphon off all that sweet sweet user data Rinse and repeat. Get away with it every time. People still go "oh I don't see the problem, they said $reasons". This time "it's stored locally". Until it won't.
    - kccqzy 1y ago
      You are merely objecting to Microsoft being the developer behind Recall. Great I don't fault you for that. But now consider hypothetically what if the Linux Foundation developed and announced Recall?
      - 63stack 1y ago
        The linux foundation would introduce this is an optional thing you can download, with documentation on how it works, and where you can find the source. Within 3 days the community would make self hosted servers for it. They are not known for siphoning user data through dark patterns, so there is nothing to object from me. If they were to try it the same underhanded way as microsoft, I'd be just as much against it.
LauraMedia 1y ago
I think there is a difference between "I can audit the code, it's encrypted, I want to run this and want to use this" and "Microsoft installs it, it's not encrypted and wants to turn it on by default, potentially sharing data to them soon(tm)"
ksynwa 1y ago
The technology is cool. It's microsoft that's not. Tools like this already existed on Mac.
embedding-shape 1y ago
> When Recall was announced, I was in minority who thought it was super cool technology. I think almost every serious computer professional want something like Recall, I don't think you were in the minority at all. But the amount of people who want the least security-minded company of probably all time to manage that software, and for that program to ignore the last three decades of security/privacy methodologies, is probably something way less people want, and is why Recall is being shit on. If a non-profit managed it, it had a security/privacy-first mindset/goals, and was run by non-Microsoft people, I think it could be a really useful tool.
andrepd 1y ago
Like several modern pieces of technology, it would in fact be "super cool" if only it ran locally and respected your privacy, and if it weren't in fact just a paper-thin excuse for massive and constant surveillance.

XorNot 1y ago

There's nothing wrong with the concept, but if it's not local with you in total control of the data then it's also just a no go.

noir_lord 1y ago

> I was in minority who thought it was super cool technology. The technology can be cool while still be a horrific idea because of the implementation and privacy implications.

compsciphd 1y ago
the privacy implications are really no worse than people who have a web browser cache/history, use a password manager, and have their entire email/message history available for offline perusal on their computer/device. just like an attacker can go after the recall data, they can go after those well known sources of data as well, which are generally not encrypted. Which is why, for example, the changes signal made to prevent recall from working when it was visible, were pure virtue signalling. By default signal on the PC keeps all messages sent available in a db that any attacker can easily download. The entire criticism aimed at recall ignored all the other ways this data is stored on one's PC.
meowface 1y ago
As long as it's stored and processed locally, I don't really see the implications being that much worse than someone getting all your local IRC/IM/email logs. (Those or their equivalents are stored in the cloud nowadays but disregard that for now for the sake of argument.)
- mschuster91 1y ago
  > As long as it's stored and processed locally Anything stored locally can be exfiltrated by malware. Run OCR on the archives, check when someone opens their password manager, copy and exfiltrate the password. Oh and partners, ex-partners and children can also abuse such data. Even if you clear your browsing history, forget about clearing the Recall cache and whoops, they can see your browsing habits post-facto. Employers and law enforcement agencies are another bad actor that's to guard against. Even if laws such as GDPR or employee safety regulations prohibit companies from screenrecording, there's not much stopping them from using a feature Microsoft tries its hardest to prevent people from opting out of.
- 63stack 1y ago
  It has been over a decade that big tech has been playing this script: * Introduce a feature that is abysmal for user privacy * Promise it's okay because $reasons * Make the feature opt-out * Change the EULA so that $reasons are no longer applicable/valid * Roll out an update that "accidentally" turns the feature back on for everyone * Apologize, deny, divert, deflect * Siphon off all that sweet sweet user data Rinse and repeat. Get away with it every time. People still go "oh I don't see the problem, they said $reasons". This time "it's stored locally". Until it won't.
  - kccqzy 1y ago
    You are merely objecting to Microsoft being the developer behind Recall. Great I don't fault you for that. But now consider hypothetically what if the Linux Foundation developed and announced Recall?
    - 63stack 1y ago
      The linux foundation would introduce this is an optional thing you can download, with documentation on how it works, and where you can find the source. Within 3 days the community would make self hosted servers for it. They are not known for siphoning user data through dark patterns, so there is nothing to object from me. If they were to try it the same underhanded way as microsoft, I'd be just as much against it.

LauraMedia 1y ago

I think there is a difference between "I can audit the code, it's encrypted, I want to run this and want to use this" and "Microsoft installs it, it's not encrypted and wants to turn it on by default, potentially sharing data to them soon(tm)"

ksynwa 1y ago

The technology is cool. It's microsoft that's not. Tools like this already existed on Mac.

embedding-shape 1y ago

> When Recall was announced, I was in minority who thought it was super cool technology. I think almost every serious computer professional want something like Recall, I don't think you were in the minority at all. But the amount of people who want the least security-minded company of probably all time to manage that software, and for that program to ignore the last three decades of security/privacy methodologies, is probably something way less people want, and is why Recall is being shit on. If a non-profit managed it, it had a security/privacy-first mindset/goals, and was run by non-Microsoft people, I think it could be a really useful tool.

andrepd 1y ago

Like several modern pieces of technology, it would in fact be "super cool" if only it ran locally and respected your privacy, and if it weren't in fact just a paper-thin excuse for massive and constant surveillance.