If one chats/mails with a person using Windows, despite using secure private protocols, every message will be stored by Microsoft’s Windoze Recall. Either I’m missing something but this feature seems like the most grotesque breach in online privacy/security.
What are ways to avoid this except for using obfuscated text?
The best way is to use comms channels that avoid their Windows install entirely. If Recall never sees it, it never gets recorded.
If there’s anything sensitive I’m communicating with someone digitally, I make sure that the person in question has basic tech security skills and knowledge about privacy, including telling them to stop using Windows. Including taking the time to teach them basic stuff (like full disk encryption, VPN and Tor usage, explaining E2EE, etc) myself. If you have a high threat model but are talking to non-techy people, you should be taking the time out of your day to do this.
If you’re thinking “wow I can’t be bothered to do all that”, your messaging is probably not sensitive enough for this to be a significant concern. Not that “if you have nothing to hide you have nothing to fear”, but just “the amount of time you put into security and privacy should be proportionate to your threat model and the cost of compromise”.
Either use secure, encrypted VoIP calls (e.g. over Signal or another secure messenger with an end-to-end encrypted call feature)
Or you use a secure messenger that only runs on smartphones and doesn’t have a desktop client
This is just horrible, fuck big tech and their services
Absolutely
If you tell something to someone else, assume it’s compromised.
Wow, valid issue.
Spitballing, potentially a secure app could run memory only, blah, blah, blah. Nope, you’ve given M$ your screen FFS, it’s all over. If you care, move elsewhere, tell your friends…
As you point out, codes are an option, but it’s not a slippery slope, it’s a waterslide.
It can be turned off so it’s up to the person you’re messaging. Once you send something the person at the other end is in control of what happens to it.
Once you send something the person at the other end is in control of what happens to it.
True, but this is the beauty of trust. I decide to communicate one way or another with someone depending on the level of trust. Them deciding to break that trust is a risk I chose to take. However, I do not choose to communicate with Microsoft, whatsoever. Windows Recall is the most blatant piece of spyware ever; beyond comprehension how this is so normalized.
Society just needs to get over this AI fad atm. By which I’m not trying to say that AI won’t revolutionize pretty much everything in our lives eventually, but first we need to figure out what it can actually be useful for. Or rather non-tech people need to be fully introduced to both its benefits and its pitfalls before tech companies will have a clear picture of where the red lines are for people ideologically speaking. We the nerds have our moral compass figured out but we’re a minority when it comes to who these products are made for.
Leave it to Microsoft to come up with the most dystopian AI concept yet. But to be honest I’d be way more wary of a company like Alphabet for whom data collection is much more central to their business model and who know how to package their spyware neatly. Microsoft announcing this as a feature from a podium shows how tonedeaf they are but I’d argue it also shows that they’re not following some self-serving plan behind the scenes to take advantage of that thing they’re so proud of publically (a mass espionage at which I firmly believe they wouldn’t be anywhere near efficient enough if they tried). They really must’ve thought that this is what can get Windows back into the limelight. It is Microsoft’s problem of our time that with everyone being on smartphones and tablets now they are losing traction in the consumer market by the day.
Point being (as far as the valid privacy concerns go) that Microsoft were never in the data business. They’re just really really bad at understanding what consumers want out of an operating system. I got my first own PC in 2001 right when XP came out. They’ve always been bad at making things work for the user. And since Vista all they’ve really been doing is copying Apple’s eyecandy. First off of macOS (then OS X), now with Windows 11 they basically want to look like a tablet OS with app icons once again after that idea failed spectacularly under Windows 8. I’m basically just rambling at this point but it should go to illustrate their lacklustre corporate decisionmaking. I wouldn’t be worried about their potential desire much less their ability to compromise that Recall data. Yes it’s a hugely concerning concept from a privacy standpoint and every step to circumvent its analysis should and arguably must be taken, but I also wouldn’t lose sleep over the data it is collecting on other people’s machines.
You have to trust the person you’re communicating with has turned it off. That’s my point. It’s an optional feature
Don’t forget that while they managed the PR better, apple “Intelligence” also has access to damn near everything on your devices.
Yet there’s no backlash because they’re not so stupid as to say “we’re gonna take screenshots as you go so we can improve your digital life kthxbye”.
“Private cloud” as if that isn’t an oxymoron.
I’m in Europe :p
who cares? try to prove anything
Europe has decent privacy laws, that’s how I avoid it
I’m afraid this comment shows a severe underestimation of the gravity of this issue. Windows recall doesn’t stop at borders even if it were illegal there.
Well, it’s not here yet. And I do use windows 11, as does my mom, my grandparents and other pc’s I’m the one helping with. I don’t recall any recalls :p
And if they do push it here, it’s probably followed by a news headline “eu fined Microsoft 10 billion for gdpr violation” or something like that
EU fines take way longer then that, give it a couple years of data collection and if we’re lucky they get fined
Their warnings tend to be a bit quicker
Ugh, I didnt think about that😬
Me neither! Microsoft needs to be taken to court over this because it is a serious breach of privacy to not only record the users but even random bystanders as well. Now I am convinced this is just a backdoor for the government hiding in plain sight. Fuck them.
Oh this 100% is the government backdoor that they’ve been begging for. “If you can innovate your way into it, you can innovate a way out of it.”
That was in regards to Apple phones belonging to Boston bombers being encrypted and locked.
It’s no surprise that behind closed doors, the government asked these companies to create backdoors for them to spy on people.
You can’t, at that point you assume your correspondent is compromised. It’s not just recall but also malware and credential stealers. Doesn’t matter if recall is taking screenshots, if the messaging client itself is pwned via malware then they have full access to as much history as is available.
To my knowledge, there isn’t. But you can ask the person to turn off recall. I’m going to be running 11 in a VM myself so /me shrugs
The code for Recall is in the code for File Manger. Recall cannot be turned off if you want Windows to load and function.
There’s literally an option to turn it off
like all the privacy toggles on facebook? or the “dont upload my start menu searches to bing pretty please” group policy on windows that doesn’t fucking work anymore?