Recall Recall? Microsoft's AI feature a hacker's wet dream

5 Likes

both of those are wild, and not in a good way :confused:

i mean, spying is almost expected. but disabling auto-save? that is them being jerks.

i believe it’s “rather large giraffe”. though i’m not sure if we’re the toddler, or if microsoft is, in this particular situation

4 Likes

Well, MS have certainly got a lot of neck to release this garbage on an unsuspecting user base. :wink:

4 Likes

Oh, Rekall :notes:Rekall :notes:

“A friend of mine tried one of their special offers. Nearly got himself lobotomized!”

7 Likes

I thought the uses cases were “I was editing something yesterday that had the word pickle in it…where was that? What was it?”

Which is marginally possible by looking at all the files with the word pickle in them that have a modification date of yesterday or today, but that may have false hits in things edited today (because you can’t rule out that they were edited yesterday and then today), but it also misses anything you edited on a web browser the the word pickle in it, but does not exist in a local file (or I guess edited with vi on some remote machine via ssh). It also misses any files that had the word pickle in it when you edited it yesterday but no longer have the word.

The price of “ok, so now a plaintext database of all the words that have been on my screen is now stored in my account” may well be too high to pay for the benefit of “being able to search for things that were on my screen but maybe not otherwise on my computer”, but there really is a benefit.

(and I’m speaking as someone who doesn’t use a windows machine, so I’ll be getting neither the benefits nor drawbacks…if it comes to the OS I use I will likely have it off unless it can be set to not record any of the various screens that show passwords in cleartext)

1 Like

Don’t ask about my antipathy for OneDrive persistently sharing my work across our network :face_with_symbols_over_mouth:

7 Likes

Also in healthcare and this is basically the worst idea.

Even if the hospital clings onto an pre-recall version what about all of the people remote accesing EMRs or other electronic communications from home workstations. PIA/STRAs (privacy and security reviews) are painfull enough already now :joy:

5 Likes

If it’s a local or networked file, there’s the search function in File explorer, which should also work for OneDrive, I think.

I have zero desire to have some application screen shotting me every x time interval on the off chance I need to look for something from days prior, especially when there are already a search service running in the background already that indexes my files (including their content!) and emails (Outlook uses the local search indexer for it’s crap, even if it’s not running in cached exchange mode). I have negative desire to have what I’m doing fed to some LLM to be regurgitated back to me at some point (or worse, fed to someone else without my explicit consent) as a over-wrought search engine front end.

:: mic drop ::

4 Likes

If it is a local file, or on some indexed shared volume and still contains the search term where this new feature searches for anything you had on your screen so it’ll find files where you remember something that has been removed (maybe by someone else, or maybe the only thing you remember is “I took the word pickle out”).

I have a great deal of sympathy for the “I don’t want it and it had better be easy to turn off and had better not turn itself back on!” point of view. My quibble was with the statement you made of “this doesn’t even have a use case!”

It definitely has a use case. That use case may not outweigh the privacy issues, or the performance issues. Or the AI interface may not work well enough for it to deliver on the use case (I’m just taking their word for it that it can OCR screen text well enough to be useful…and parse a spoken query in a way that is useful).

“this juice isn’t worth the squeeze to me!” is a different statement from “you can’t get juice out of that rock no matter how hard you squeeze!” (or even “that juice isn’t worth the squeeze to anyone/most people”)

There is a 3rd party product for the Mac, and some people really get some significant value out of it. It being a 3rd party product means you need to think you might get value out of it to bother installing it which is as good as an OS feature defaulting to “off”. I don’t think the 3rd party Mac product has particularly great security (they keep the data local, and I think they encrypt it, but the key is inside the app so if you broke into a system that was using it you could extract the key from the app and read the data file, from a CS perspective it adds no security over a plain text file).

1 Like

Don’t worry! With Windows 365 Enterprise Cloud PC, Enterprise Mobility and Security E5, and Purview data security and compliance solutions you’ll be able to provide BYOD users secure access to a full range of productivity tools and line-of-business apps!

For reasons that the FTC should definitely not spend any time investigating; they are hard and technical and you really wouldn’t understand the Age of AI and the security benefits of the Hyperscale Cloud, pesky competitor VDI offerings will be mysteriously significantly harder to exempt from ‘Recall’ screenshotting; just as Edge private windows are exempted but competing browsers are not.

I’d like to say that I’m being snarky; but as best I can tell Microsoft’s cybersecurity and compliance product lines exist on the axiom that if you are having a problem with the Microsoft ecosystem it can be solved by buying more of the Microsoft ecosystem and doubling down. They don’t always actively create the problem that they sell you the solution to; some of them do appear to be genuine side effects of more or less good faith sensible choices; but there are absolutely some cases where the problem is a clear side effect of another business unit chasing its own imperatives(things like AAD user Oauth grant defaults; or the teams app plugin permisison model; or default AAD guest user permissions); and then there are the ones where stuff is pretty clearly just being cut from products it should be a part of in order to sell more security services; like the now-infamous ‘MailItemsAccessed’ audit log entry; available as part of “Audit (Premium)” with the E5 compliance add-on; that CISA was super-unthrilled about.

6 Likes

This topic was automatically closed after 5 days. New replies are no longer allowed.