Recall the Recall recall? Microsoft thinks it can make that Windows feature palatable Microsoft has revised the Recall feature for its Copilot+ PCs and insists that the self-surveillance system is secure. "Recall," as Microsoft describes it, "is designed to help you instantly and securely find what you’ve seen on your PC." You may not recall what you were doing on your PC but rest assured that Microsoft's …
Pointing .bash_history to /dev/null is opt-in. Assuming you have some say in such matters. I've used systems in the past where I didn't and, I recall it being creepy enough just wondering if I might be judged for over-using ls every other command.
But okay, the Windows version is next level.
I might be judged for over-using ls every other command.
I have a tendency to create a new directory, cd into it and immediately 'ls'. Quite what I am expecting to find in a newly created directory, I'm not sure? And when I don't find anything I often 'ls -a' just to be sure. I know I'm doing it, but my fingers just seem to have it as muscle memory.
And even if Microsoft is successful at filtering out sensitive data, they have still created the software infrastructure that a hacker can exploit to reliably collect that data. So now some simple compact malware may be all that's needed do the job.
At least they are making someone's job easier.
Keyword detection is and will be plagued by false positive and negative errors, and heavily biased to a few nations version of PMI.
The opt-in is also a lie. They wills steal as much data as they can, but they are willing to give up the personal computing activity of those who control their machines and can actially consent themselves. Anyone that is a student, employee, or member of the paranoid forces will of course not be able choose for themselves. M$ will probably and predictably allow HR to order IT to turn in on without asking the meat behind the keyboard, blowing off a toe on the other foot with this mighty hand cannon of a Footgun. They will then add a disclosure pop-up as ordered in the next lawsuit that is coming.
Even without M$ active enabling of non-consensual surveillance and data use, 3rd parties will step in and there will be a new option in your Fortinet or Crowdstrike console to silently enforce the settings and bleed information out of the enclave using the organizations access.
We all know perfectly well what it's for, it's for companies to spy on employees to make sure you're working your 8 hours solid and not doing stupid things like taking breaks for coffee, lunch and going for a wotnot, all those activities that companies classify as wasting time rather than working 100% of the contracted 7-8 hours a day.
They can do that already of course, but what it is collecting isn't really a good fit for that or their claimed first use case. Which isn't to say that it won't be usable to allow a search of recent activity or in an attempt to track worker drones "output". Sadly they have worked hard to break local search increasingly badly with each major update, and intentionally broke their online search to sling more ads and links to bogus sites and content farmed.
So they have much grander ambitions to this then just workplace surveillance, which is why after giving the initial bleeding a chance to stop they have reached for the footgun again.
This is the on ramp for them to use activity data to try to drive "automation". The first wave of that will be sold to users as a way to make their life easier in exchange for their last vestiges of privacy. The next wave will sold to your manager with a pitch that is expensive but still cheaper than you, and unlike you, they can issue bug fixes. The third wave will be sold to the board to make most of the remaining employees redundant, and the last will be sold to large shareholders as a way to remove inefficient board-members that aren't doing everything possible to maximize quarterly profits.
1. Up and coming politician
2. CEO of a major company.
3. Military commander somewhere
4. Researcher at a drugs company.
5. Medical doctor.
6. High school teacher.
I could think of lots more professions that recall should be no where near, as microsoft's 'security' promises have repeatedly proved to be not worth anything as recall will be THE prime target for any hackers breaking into your system, and besides, I bet recall will be sent to onedrive by default anyway, with the security implications that brings....
> I could think of lots more professions that recall should be no where near
That's the mistake: all of the "enterprise" versions of Windows, joined to an AD domain, have group policies to turn this sh!t off! ;-D
This is only for the peasants. As much money as they've thrust into AI, and this their only "product" to show for it, open up, so they can start shoving--!
"That's the mistake: all of the "enterprise" versions of Windows, joined to an AD domain, have group policies to turn this sh!t off! ;-D"
Or group policies to turn it *ON*, where the enterprise decides it wants to have a way to keep an eye on employees and/or contractors.
I'm sure there are GDPR-related issues with such a scenario...
Yes, there will be managers or companies salivating at the thought of the staff "metrics" they can gather from this. The sensible ones will be throwing their hands up in horror and making sure the policies turn it all off. And then there will be the whistle-blowers pointing to employers who have it turned on in violation of all sorts of security agreements, including GDPR, anyone processing card payments or just dealing with anything government/secret/security related.
I predict the first casualty will be a local government org somewhere where the elected officials refuse to listen to the IT people, mainly because elected officials rarely remember anything and will think this is a huge boon to them personally since they will think they can save money by doing away with assistants.
"I bet recall will be sent to onedrive by default anyway, with the security implications that brings...."
Well, duh, how else is M$ to parse their, I mean, your data in peace? They'll need it under their control in case you do something offensive like shut your machine off.
You've trod in something, thought you've scraped it off, but the smell tells you you were mistaken!
BBC's version of the story notes that <cough> 'diagnostic data' may be sent back to the mothership unless you find the off switch in the bottom of a filing cabinet in a disused toilet in the basement with the 'beware of the leopard' sign on the door
Oh I forgot, there’s my WFH PC, supplied by work, controlled by work...
I'm very happy that I use (several) Macs for WFH..
(Yes, the Intel one does have a company-build VM running under Parallels but I only fire it up when I have to do stull where there's no application for it on the Mac).
I keep booting Windows back up because there are some games and a few other applications that just resolutely will not run on Linux, and so I was considering throwing in the towel on the Linux experiment, but this crap reminds me why to keep plugging away at it or at least to keep anything sensitive on Linux.
The fact that Microsoft have somewhat latterly decided to bolt on security rather than considering the privacy implications from the inception of Recall says a lot about the development philosophy behind the feature.
No, it's to sell the spy-as-a-service to companies needing to check we plebs are working 8 hours a day, especially WFH is more prevalent now, 'cos companies see all those coffee and toilet breaks as a wasting company time and money, with Recall they have proof you wasted 47.6 secs going for a pee and grabbing a biccie when things got busy!
The fact that Microsoft have somewhat latterly decided to bolt on security rather than considering the privacy implications from the inception of Recall says a lot about the development philosophy behindthe featureeverything they have ever created since the beginning of the Windows era.
There, FTFY
is not that the screenshots might be stolen or sent to the mothership. It is that the mothership will send queries to the AI which will then return the results. These queries may be made by Microsoft for its own benefit or on behalf of TLAs or whomsoever pays enough. If it can be removed from my corporate laptop then it will be removed.
That intersected with a thought just before I read that. :)
With moderate short term memory loss the idea might not be so odd. As it is I suspect many of us already use google/bing/duck as an auxiliary memory.
The thought that struck me was if I depended on a device for pretty much the entirety of my memory (short,medium,long term) I would pretty much have ceased to be [me] but just some coprocessor for the device to "experience" those memories - real or hallucinatory. Even the experience of the normal passing of time would vanish - if the device replayed the memories in reverse order you would not be any the wiser.
Even if MS do permit users to turn off the recall feature I would be concerned to what extent the base Windows [11?] has been instrumented to allow recall to work and whether those hooks could be hijacked by other clandestine surveillance software.
Goes without saying that I don't use Windows (or have any need to) but if recall gets any traction I can see desktop Linux distros offering something similar - another addition to systemd's already vast estate? :(
It's presumably just hitting Print Screen every time. Screen recorders can do the same, but are asked to show onscreen indicators while running.
If literally anything else was doing that continuously without live indication Microsoft would be screaming, but it's fine if they're the ones exfiltrating the data.
I wonder how long it will take to fill the local SSD?
It'll be fine. It'll automatically pop up an advert inviting you to buy more. Or just automatically upgrade you to the next tier of One Drive storage.
But there will be related issues, like SSD wear or just the amount of memory and CPU it'll suck up. But you wanted to upgrade all your PCs, didn't you? It'll be like the dark days of MS's search/index processes continually running and still never being able to find what you're looking for.
The whole thing is just nucking futs. So I have 3x4K monitors on this box. They may variously have games, videos, documents, compilers, web pages open at the same time. Some of which might contain copyright content, so MS can't, and I can't authorise MS to make copies of that content. I just can't think of any reason why I'd need or want MS to take screenshots, process and store any of that stuff every few seconds. I guess it might give MS valuable marketing data, like the most common activity being users trying to find ways to terminate any and all 'AI' processes with extreme prejudice.
Which is the first thing I asked Copilot to find for me. As is often the case with 'AI', I didn't get any good answer.
How about just having Windows installation just giving you the operating system plus a simple web browser with a gateway to - say - The MS Crudstore, where you can get all the accessories, and maybe a free fone number where you can order a DVD or two with it on.
Then you can install all that stuff you so badly want, like XBox, Edge, Copilot, Recall, Orifice 365 teasers, etc to your hearts content.. Or just ignore 99% or it.
How would MS make any money? The days where you bought software and it did exactly what it promised on the box, those days disappeared back around 1999 my friend. Software is for data gathering first and foremost, any productivity you experience with software is purely incidental these days!
Maybe I missed it but as far as I know Microsoft has never been able to produce software that did as proclaimed on the box. Hardware, yes, but software has forever been a mess.
I may have missed something, of course, I've only had MS software forced on me by various places since MS-DOS 3.2 so maybe before then that made something that wasn't bloat and only vaguely did what it promised on the box, but the fact that XENIX is no more suggests it didn't make enough profit with Operating Systems built on a reasonable solid foundation.
It's okay guys, Uncle Microsoft is here to save the day with AI and totally isn't interested in your data, no siree. Surprised they bothered supporting any browser other than edge, given how it would be additional leverage to swap to the hell-browser....
It feels that with every Windows install I do, ~70% of the time isn't so much installing the OS as uninstalling all the crap it comes with.
"Recall is designed with security and privacy in mind,"
In that case how was it that they had created "unique security challenges" and that few if any of these claimed security features were originally present? Does that mean that in a few months they've completely redesigned and reimplemented it or have they just bolted Sellotaped on as an afterthought as much as they could come up with in a brain-storming session?
Based on recent news stories re Disney and Uber Ts&Cs for minor interactions with then removing your right to sue them at all, for anything, in the USA, I'd not be surprised if that sort of term was actually in the MS licence and that the US legal system would uphold it as valid and legal.
Are right there in many other things. In some countries, that clause is illegal. That does not stop the likes of Trump and his $100,000 watch. Delivery? Sometime never but sorry sucker, you can't sue.
FSCK all companies who try to remove our rights to sue for breach of contract.
>Based on recent news stories re Disney and Uber Ts&Cs
But these were in part about history, so you might need to dig out that Windows Phone agreement (or even WfWg EULA) to see if it can be linked to you and to discover if it contains any terms and conditions that MS may wish to deem are part of your current agreement with them. Obviously, you are unable to do similar and demand that W10+ has been sold to you under the MS-DOS EULA...
Thank goodness I dumped Microsoft (Windows) at the start of the Pandemic, when I had time to immerse myself in Linux. Who's to say an update to Windows won't "accidentally" turn on this crap? It has happened multiple times before. Apart from that, it is a massive Malware target that even at this minute, Nefarious State Actors and Script kiddies are working out how to monetise it. No OS is totally immune, but Windows is a really leaky bucket.
What i find quite worrying is that there is absolutely no uproar about Microsoft coming out with this product called Recall.
The slow migration of surveillance of all the people, which started online, and now on the very PC you own, without any general public reaction, is perplexing.
This is not about whether you have something to hide, but about peoples privacy and security.
If North Korea was reported to have this capability on their only allowed OS, then it would be expected and discussed with great derision of the totalitarian state.
The difference here is that the west (Microsoft) is saying it is for your benefit, and the pariah states are accepting that it is for their benefit.
Microsoft is acting like an abusive partner, telling you that they have your best interests at heart, whilst having the ability to track everything you do.
I suspect that altogether too many businesses will see Recall as a good thing. You know, all those corporates that like to lock down their users as completely as possible with group policies will now have built-in spyware at their disposal too. The hardware manufacturers will love it because they'll be hoping it's the killer app for local AI that they really need to sell that shit.
Precisely! No need to buy corp spy software, you can no get it as part of the Windows enterprise license, baked into the system and I'll bet that within a year there'll be a console you can install ready to tap any laptop or desktop's Recall cache, perfect tool for paranoid PHBs to check we plebs are earning our daily scheckles and not wasting time going to the toilet or eating lunch!
"Businesses will seek out PCs without NPU."
You are assuming that that will still be possible in a couple of years time. When did you last try to buy a "smart" tv? Or new car that is not "connected" in some way? Consumer "choice" is limited by what is actually available. You can have any colour you want so long as it is black.
quote: Access requires the user's Windows Hello Enhanced Sign-in Security identity...
Or a court order. Just like dashcams and doorbell cams.
Companies will implement it so they can spy on their employees 24/7. You are using a company machine after all. And then it will get hacked or subpoenaed.
You can turn it off, but if it is there, someone may find a way of covertly turning it on. It saves spooks and hackers from going to all the trouble of installing their own version on your system.
With this, AI, subscriptions, cloud back-ups, and lock ins, it really is time for a new basic retail system that works without all this crud. We need to go back to the future, with hindsight. Or work offline on a retro system and just use a tablet for online stuff.
In the meantime, Microsoft's endless conveyor belt of toxic gimmicks just yells 'switch to Linux'. Not because Linux is great, or because you want to, but because it isn't what the Windows ecosystem has become.
>someone may find a way of covertly turning it on.
That functionality will be built in, by request of one or more US three-letter agencies.
Naturally, MS are, due to gagging orders, unable to tell you this or deny the functionality exists.
I suspect whilst we may not have the great firewall (like China), the agencies are implementing the snooping and data gathering it requires.
by using:
Gmail, you give them permission to read all of it, for marketing purposes, same with chrome browser
FB, you give them same,
MS is moving to the free model - where yep, you are the product too.
If QC ran on linux natively, I would drop windows completely. Come on Id Software, do it.
"No" means "No". It does not mean "Try harder", nor does it mean "see if you can work back around to it slowly, so they don't notice you doing it the next time".
It does not mean "Keep trying to talk them into it, but let them choose each time whether or not to opt in, at least to begin with".
The creeping enshitification of everything is an inevitable consequence, when a bad idea being shot down in flames, instead of making the originator say "Oh, perhaps that was a bad idea", makes them say "Oh, perhaps I should find a way to introduce this more gradually".
We don't object to your bad idea because it's a great idea that you tried to impose too fast; We object because it's a bad idea.
We said "No". The appropriate response is to drop the whole stupid and unwanted idea. The appropriate response is NOT to try to boil us more slowly, like a bunch of frogs.
Or when there's real legal protection for data stored on your computer. i.e. it's simply forbidden to use the data by law, even then it's dubious because govt. agencies have long track records of ignoring privacy laws.
My money is that Hell will freeze over sooner.
> That depends on how "solid" it is, it may not roll easily lol
Well, I would argue that anything above a "4" on the Bristol Stool Chart is not a "Turd", but a "squit".
And to keep "on topic", I await the next "release" from the "bowels" of Microsoft, to see if it can be polished and/or glittered, without the aid of spray lacquer..
See title.
Because Microsoft is to security what Donald Trump is to morality.
The company I work for (or at least log in to) for has a CIO who absolutely loves Microsoft, god knows why, and wants us to run everything in Azure with lashings of AI, come what may. I believe even she would think this is a small step too far.
Even if the training data - the screenshots are completely encrypted and secured, there is another way in: The middle layer weights of the trained neural network will contain transformed versions of the sensitive training data which can be accessed simply by dumping the memory.
You can do what you want.... as a standalone, optional, download-it-yourself-from-the-Windows-Store app, with no advertising in the OS to try to get you to click on the thing by mistake.
If it's so brilliant, millions of people will download it and use it and then you have a case for including it in the OS (disabled by default, obviously).
If it's not... meh. Well. There ya go. You offended, hurt, inconvenienced, compromised nobody.
When you have to force your products / options / changes down people's throats, it just tells me that nobody would choose to use them of their own free will.
See Active Desktop, Copilot, Internet Explorer, Edge, etc.
My understanding is there is only one binary for windows, and the serial number turns bits on and off. Pretty sure that was true in the past for say home and server windows, not really sure about today.
WHat im trying to say is while the special gov versions might have recall "off" the recall code is still there.
There are several stories from MS about an equivalent problem with some older version of XL where there was a flight sim an d pinball game "inside". Im guessing these same US GOV agencies complained about torjans like these games being inside XL and MS was forced to remove all traces.
M$ is moving he responsibility to the "user".
The vast amount of M$ users I know do care about the settings in their OS - they hit "allow" once and never look back.
They do not know that they can, or should, do so. Or know how.
We, El Reg readers, are "safe" for the time being as we know how to avoid this stuff. But the ignorant majority is not.
Somebody should stand up and protect the masses from being sucked out by companies doing this sh*t.
Really.
So let me get this straight...
MS, who has yet to release a secure operating system, or learn how to patch without breaking more than they fix... Who is trying to move everyone over to Win 11 from Win 10, when in reality Win 11 IS nothing more than Win 10 with a half-breed interface and more invasive telemetry, now thinks they're going to make the migration more attractive by including surveillance-ware that records every thing you do. They're claiming opt-outs..etc.. but we all know that won't last long... As there's absolutely no end-user call for this type of functionality, it suggests to me that it's being done at the behest of other parties who want a literal recording of all you do/say/view. This isn't even well disguised surveillance... it's rather blatant.. and all the polishing of the turd by the marketing bods isn't going to change that..
I'm a software developer, and I'll sit having a quick skim through El Reg whilst waiting the 10 minutes or so for my code to build or the database models the application runs on to publish as I'm working.
The company's been getting really quite ridiculously paranoid recently about security and work effort from people across the business, to the point where as devs, we've lost local admin access to our machines [making it harder to test the windows services or full-blown IIS sites that make up the company application]. As a business as a whole, we're having heavy security monitoring of things we do online now, so I can totally see that at some point in the near future the company will be using Recall to monitor our actual screen time on if we're actually working, or ... in my case reading The Reg.
I can't see any real user value for Recall, but I can totally get the stalkery business value for it. A native online presence feature that avoids covering the camera or mic with tape, and could easily spot mouse jiggers.
"As a business as a whole, we're having heavy security monitoring of things we do online now, so I can totally see that at some point in the near future the company will be using Recall to monitor our actual screen time on if we're actually working, or ... in my case reading The Reg."
If they start blocking access to StackOverflow then I guess all "development" activity (i.e. cut-n-pasting "random" bits of code from there) will cease...
It's good that Microsoft have expended all this effort in an attempt to make this data slurp feature secure, but they still fail to provide a good reason why it is necessary to store all this data because the best thing for user security is to not store that data at all. As far as I can see, the "advantage" this system has is that you can search the stuff you've done. But, Windows, Mac OS and (presumably) Linux can already do this without reading everything that appears on screen.
For years I've seen the "nOW Is tEh WiNTeR oF LinUX, sHeEpLe" posts after every major Microsoft offering, major system change or hiccup. For years I've scoffed and rebuked the idea.
This is different. This is the first time I see Microsoft OS being something I'd be wholly unwilling to deploy in a corporate environment. I've dealt with the other idiocy, removed Game Bar and Candy Crush from desktop instances, slogged through ME, Vista, 8.0 and the disastrous patronising launch event for the latter. I've swallowed outages, missing configs and the ever-moving settings that no longer marry their own guidance & help.
If Recall gets pushed through, this is where I draw the line. Microsoft should note, it's not just OS. I pull the OS and back out of Office, obviously. That pulls my OneDrive too, and I need no SharePoint integration so 365 drops. Without 365 I'm not beholden to Teams so my Teams Phone moves to 8x8 or similar. No Office/OS means no Defender and I pull MS Project and Visio because why not. If I've got no Microsoft Stack, and having witnessed how much Dynamics hates anything other than Edge, that ERP project I'm starting in 12-18mths excludes Dynamics F&O, and I start to look at how I can get off Dynamics Sales. If I'm not running those, I'm not beholden to that SQL instance in Azure, so that goes, as does the rest of that estate as I don't need Entra now.
This gets costly for them, really, really quickly.
It's probably only because I'm just too much of a cynical bastard that this conjures images of a fullscreen 'user choice' screen every time you boot, with a giant "YES ENABLE RECALL" button in the centre and a 5px text link "No, but ask me again next time" in the lower left corner.
And there definitely won't be an unfortunate bug that causes the 'no' link to have a text colour identical to the background and be placed in a random position.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
