News for hackers. Stuff that matters.
Re:Recall: Stealing everything you've ever typed or viewed o... by oefrha on Friday May 31, 2024 @08:09PM (#40541587)
> Everything a user has ever seen, ordered by application. Every bit of text the user has seen, with some minor exceptions (e.g. Microsoft Edge InPrivate mode is excluded, but Google Chrome isn’t).

Microsoft was the company that used to add bespoke code to Windows to maintain compatibility with old third party software, patch explorer.exe to stop third party customizations from crashing it, etc. While the whole Recall thing is a pretty bad idea for most users, the lack of care extended to the third party browser with overwhelming market share among their users is just sad. Are they counting on people switching to Edge because “PSA: you’ll be recorded if you watch pr0n in Chrome!”?

Re:Recall: Stealing everything you've ever typed or viewed o... by Workaccount2 on Friday May 31, 2024 @08:23PM (#40541675)
Watching users flock to Apple's walled garden, to the point where it's a social issue to not have an iPhone, has left Microsoft (and many others) wondering why the fuck they have been so accommodating to user choices for all this time.
Re:Recall: Stealing everything you've ever typed or viewed o... by leereeves on Friday May 31, 2024 @08:40PM (#40541776)
Outside of high school, where literally everything is a reason to ostracize people who are different, where is it a social issue to not have an iPhone?
Re:Recall: Stealing everything you've ever typed or viewed o... by lwhalen on Friday May 31, 2024 @08:45PM (#40541811)
I've been married for ages (so I can't speak to this first-hand), but my single friends in their late-20s to mid-30s say that NOT having an iPhone gets them rejected fairly often.
Re:Recall: Stealing everything you've ever typed or viewed o... by ryandrake on Friday May 31, 2024 @09:05PM (#40541929)
Seems to me like an effortless way for them to automatically filter out terrible, shallow partners from their lives before investing anything into a relationship. What a time-saver!
Re:Recall: Stealing everything you've ever typed or viewed o... by lwhalen on Friday May 31, 2024 @09:12PM (#40541976)
You and I are in violent agreement on this, but... the younger generation seems more interested in 'smashing' these days than 'partner-seeking'. Can't say I was MUCH different, but I certainly wouldn't change the daily-driver tech I use just to peacock for a hot date.
Re:Recall: Stealing everything you've ever typed or viewed o... by Gud on Saturday June 01, 2024 @05:17AM (#40544139)
Nothing excites a woman more than when you bend over backwards to please her.
Re:Recall: Stealing everything you've ever typed or viewed o... by acheong08 on Saturday June 01, 2024 @06:58AM (#40544603)
Perhaps that’s more prevalent in the US and wealthier districts? I haven’t seen any of that in the UK (everyone here seems to use WhatsApp, Instagram, and Snapchat which I similarly dislike)
Re:Recall: Stealing everything you've ever typed or viewed o... by snapplebobapple on Saturday June 01, 2024 @10:16AM (#40545932)
I think you are missing the first half the modern male reproductive lifecycle. What you are saying increasingly applies to 30's onward (when males are looking for long term family relationships) but for the 20 somethings many are looking for these shallow, vacuous women because they often can be convinced into meaningless sex. It's a pretty sad state but it appears to be this way now.
Re:Recall: Stealing everything you've ever typed or viewed o... by davidgerard on Monday June 03, 2024 @07:43AM (#40561706)
what the

I don't want to seem unduly cruel, but I strongly suggest examining whatever mislearnings led you to this point and get out and meet some people

Re:Recall: Stealing everything you've ever typed or viewed o... by thejohnconway on Friday May 31, 2024 @09:11PM (#40541973)
Sounds like your friends are dodging bullets without having to do anything. I say this as an iPhone user.
Re:Recall: Stealing everything you've ever typed or viewed o... by ramenbytes on Friday May 31, 2024 @10:46PM (#40542473)
Is there any possible steelman for this, or is it as shallow as it sounds?
Re:Recall: Stealing everything you've ever typed or viewed o... by Cyphase on Friday May 31, 2024 @11:10PM (#40542574)
Possible steelier arguments:

- "iPhone's are generally more expensive, Android phones are generally cheaper", so having an iPhone signals financial "goodness". Same argument can be applied to lots of other products.

- "iPhones are generally better, so if you have Android you're compromising for some reason", e.g. lack of money to buy one, "weird" political/social/other beliefs, etc.

- Messaging systems are like accents; some people might prefer dating someone who speaks their language in a more similar accent, and others might prefer dating people who use the messaging system they prefer.

Also, a lot depends on your definition of "shallow".

Re:Recall: Stealing everything you've ever typed or viewed o... by ramenbytes on Monday June 10, 2024 @02:42AM (#40630861)
I'd thought of the money one, hadn't thought about the possible signaling of "weird" beliefs.

The third point seems a little silly at first, but reflecting on my own musings on whether to go full Signal-only or not I guess I can imagine someone being iMessage only same as some people are Signal-only.

Thanks!

Re:Recall: Stealing everything you've ever typed or viewed o... by operator2140 on Saturday June 01, 2024 @11:13AM (#40546402)
maybe women don’t want their sms/mms/phone calls being leaked unencrypted over the antiquated, legacy telephony network?
Re:Recall: Stealing everything you've ever typed or viewed o... by EasyMark on Saturday June 01, 2024 @06:20PM (#40549571)
Great point. I will use this as a greater point in my Android vs Apple arguments in the future.
Re:Recall: Stealing everything you've ever typed or viewed o... by ramenbytes on Monday June 10, 2024 @02:44AM (#40630873)
As an Android user, I'd counter "Signal". Which I think would bring things back to what another comment mentioned about preferences in messaging platforms.
Re:Recall: Stealing everything you've ever typed or viewed o... by RobertRies on Tuesday June 04, 2024 @10:46AM (#40575183)
And maybe they prefer developing in Swift and/or prefer Xcode?
Re:Recall: Stealing everything you've ever typed or viewed o... by hammyhavoc on Friday May 31, 2024 @10:04PM (#40542274)
I would argue that not having an iPhone is behaving as a filter for likely incompatible pairings if not possessing a particular brand of phone is an issue to any prospective partner.
Re:Recall: Stealing everything you've ever typed or viewed o... by jay-barronville on Saturday June 01, 2024 @02:52PM (#40548144)
I’m in that age range and I’m married. A few years ago when I was still a single man, I experienced this firsthand at least a few times. My primary device wasn’t an iPhone and I had women tell me they “don’t like texting with green bubbles”…it was pretty bizarre, to say the least. In hindsight, I’m glad those women filtered themselves out, but it’s definitely really rough out there for our society’s young men.
Re:Recall: Stealing everything you've ever typed or viewed o... by EasyMark on Saturday June 01, 2024 @06:18PM (#40549560)
It can definitely be an issue on the dating apps to be a male looking for gf material if you’re using android. I think it’s because of the shallow tech knowledge of other people as to why android is as good as apple, but the heart wants what the heart wants. For those saying such people are “shallow”, it’s just as shallow to assume the same, as one data point does not tell the whole story in my experience.
Re:Recall: Stealing everything you've ever typed or viewed o... by NemoNobody on Monday June 03, 2024 @12:21PM (#40564234)
Having an iPhone was reason for me not to date someone. I'm less bothered by it now but it used to be without fail that iPhone users were just not my people.
Re:Recall: Stealing everything you've ever typed or viewed o... by jordasq on Monday June 03, 2024 @05:45PM (#40567930)
"he was perfect but oh my god he has an ANDROID!"

Every time I come on here the things I read get more and more fucking dumb.

Re:Recall: Stealing everything you've ever typed or viewed o... by throwaway22032 on Friday May 31, 2024 @08:55PM (#40541874)
It seems to be an American thing, something to do with iMessage.

Here in the UK I've literally never encountered it.

Re:Recall: Stealing everything you've ever typed or viewed o... by janice1999 on Friday May 31, 2024 @10:21PM (#40542345)
On this side of the Atlantic, not having WhatsApp installed has been far more of an issue for me.
Re:Recall: Stealing everything you've ever typed or viewed o... by brookst on Friday May 31, 2024 @10:24PM (#40542360)
Never seen it in the US either. It’s always these third-hand stories.
Re:Recall: Stealing everything you've ever typed or viewed o... by talldatethrow on Sunday June 02, 2024 @02:04AM (#40551762)
I've been a serial date since 2001. Moved to Android after an iPhone 3S mishap. So at least a decade on android.

I have heard at least 10 women JOKE about my android. I'd say atleast 2 gfs in those years eventually made some snide remark.

Will you get dumped for having an android? No. Is it a small -1 mark for most women? I would say so.

And no these aren't totally brainless women. It's been doctors, MBA grads, women in tech, a writer.. I honestly think more regular woman are more sane about it actually and wouldn't care as much as 'fancier' women.

Re:Recall: Stealing everything you've ever typed or viewed o... by cortesoft on Friday May 31, 2024 @08:16PM (#40541642)
How would this system know chrome was running incognito?
Re:Recall: Stealing everything you've ever typed or viewed o... by kccqzy on Friday May 31, 2024 @08:19PM (#40541655)
Develop an API in Windows. Contribute to the Chromium codebase to use this API.
Re:Recall: Stealing everything you've ever typed or viewed o... by willcipriano on Friday May 31, 2024 @08:25PM (#40541685)
We already have "Launch as Administrator"

add "Launch in private mode"

Re:Recall: Stealing everything you've ever typed or viewed o... by reverius42 on Saturday June 01, 2024 @10:24PM (#40550846)
So now the user has to remember to not only open a private window or tab in their browser, but also open the whole browser in private mode?
Re:Recall: Stealing everything you've ever typed or viewed o... by willcipriano on Saturday June 01, 2024 @11:09PM (#40551037)
If you want to be really consumer focused, the OS could keep the browser (and other apps) honest about some of it's privacy guarantees by not affording it any persistent storage between sessions.
Re:Recall: Stealing everything you've ever typed or viewed o... by btown on Friday May 31, 2024 @08:20PM (#40541660)
For one, OCR’ing the word Incognito from the screen?
Re:Recall: Stealing everything you've ever typed or viewed o... by Terr_ on Friday May 31, 2024 @08:24PM (#40541682)
So I just add a new custom toolbar to the bottom of the screen titled "Incognito" so that the text is always there, and suddenly nothing's being recorded anymore? :P

On one level that's convenient, but on the other hand I'm not sure it's a very robust design.

Re:Recall: Stealing everything you've ever typed or viewed o... by oefrha on Friday May 31, 2024 @08:27PM (#40541700)
That only works if you have the "New Incognito Tab" page active. Not when you're actually browsing something.
Re:Recall: Stealing everything you've ever typed or viewed o... by chuckadams on Friday May 31, 2024 @10:37PM (#40542429)
There's also the profile button at the top right, just to the left of the hamburger menu, that says "Incognito" on it.
Re:Recall: Stealing everything you've ever typed or viewed o... by oefrha on Friday May 31, 2024 @11:17PM (#40542603)
Yeah I forgot about that.
Re:Recall: Stealing everything you've ever typed or viewed o... by gitgud on Saturday June 01, 2024 @06:47AM (#40544545)
What if it’s fullscreen? What if the title bar of the window is off the screen?

A better solution would be to just pause the screen capture whenever incognito is open anywhere

Re:Recall: Stealing everything you've ever typed or viewed o... by jacoblambda on Sunday June 02, 2024 @03:12AM (#40552060)
While they seem to be adding an API for it, if you wanted you could just add a "block screenshots" API.

This is already basically in place with DRM since the windows screenshot utility won't screencap most DRMed content on win apps like netflix or even on firefox nowadays.

What MS is adding on top of this is an API to check which tabs/web pages are visible and selectively black out web pages that are added to a given user level blacklist.

Re:Recall: Stealing everything you've ever typed or viewed o... by ajross on Friday May 31, 2024 @08:13PM (#40541612)
It was surely just schedule pressure. There's no system-visible API for "incognito mode" (nor should there be, obviously, as it would defeat the purpose) so they just skipped it.

I dunno, and I say this as someone who works for a competitor and has no love for MS... a lot of the responses here seem really uncharitable. This isn't bad faith, it's just a rushed product with some poor planning. If Apple had rolled this same feature out with glitz and a giant slideshow about privacy and explained how everything was encrypted and never left the device, we'd all be crowing about how great it is even if it too was screenshotting incognito windows.

Re:Recall: Stealing everything you've ever typed or viewed o... by twinge on Friday May 31, 2024 @08:21PM (#40541665)
It seems contrary to their docs[0]:

> Recall won’t save any content from your private browsing activity when you’re using Microsoft Edge, Firefox, Opera, Google Chrome, or other Chromium-based browsers.

Without a system-level incognito mode feature I could see apps allowing users to denote their windows as DRM content to avoid Recall.

0: https://support.microsoft.com/en-us/windows/privacy-and-cont...

Re:Recall: Stealing everything you've ever typed or viewed o... by oefrha on Friday May 31, 2024 @08:33PM (#40541729)
> apps allowing users to denote their windows as DRM content to avoid Recall

That would prevent user-initiated screen captures as well. Not a good idea for browsers at least.

Re:Recall: Stealing everything you've ever typed or viewed o... by oefrha on Friday May 31, 2024 @08:25PM (#40541684)
I thought about it for a minute, and sure, given a chrome.exe HWND, I can't think of a way to tell if it's Incognito.[1] But companies work with important vendors on major features all the time. If they think it's important enough to exclude private windows in Edge, they surely could have worked with Google to figure out something.

> nor should there be, obviously, as it would defeat the purpose

No it doesn't. Incognito mode is about leaving no trace on disk, that's all. Recall is the one defeating that purpose right now, if TFA is accurate.

[1] Not saying it's impossible. Only that I can't think of a straightforward solution in a pinch with my limited Windows experience and hacking skills.

Re:Recall: Stealing everything you've ever typed or viewed o... by wizzwizz4 on Saturday June 01, 2024 @03:13PM (#40548309)
In Firefox, check for "Private Browsing" in the titlebar. In Tor Browser… default to "it's private". In stock Chromium, look for the string "Incognito" near the Chrome hamburger icon (e.g. via IAccessible2).

It's not hard to support this functionality in the major browsers: it'd take me all of 15 minutes.

Re:Recall: Stealing everything you've ever typed or viewed o... by reverius42 on Saturday June 01, 2024 @10:21PM (#40550836)
What about localization? What if a release of the browser changes the string?
Re:Recall: Stealing everything you've ever typed or viewed o... by klabb3 on Friday May 31, 2024 @10:39PM (#40542439)
> a lot of the responses here seem really uncharitable. This isn't bad faith, it's just a rushed product with some poor planning.

But it’s not the product people are criticizing, at all. Similar tools have existed for a long time and have not raised eyebrows except when it’s been forced by an employer or a school. It’s that it’s the OS putting an always on and enabled-by-default spyware on devices that are frequently shared by family members, when their average users who barely know what a web browser is and will just accept recommended defaults. Speaking of which, the whole spiel about Edge/IE is precisely their aggressive defaults. It’s the same here.

If you’re a startup building custom tools you can talk about rushed products and assume good intent. This software is built by a software company with some of the worlds best software engineers all the way up to the top. I mean, people trust them with everything from business secrets to payment details to mission critical services. This is clearly not a “rushed product oopsie”, it’s blatant disregard for privacy, and to a lesser extent, security.

I’m avoiding windows like the plague, but since seeing my mom get bombarded with “recommended Microsoft defaults” over the last decade or so, I’m convinced MS is deliberately exploiting uninformed users as much as they can get away with, while leaving hidden options for power users to disable the ads and the crapware so they don’t leave. This total recall debacle is probably a similar attempt at using their unknowing user base to train their new AI models, or similar. If it was a genuinely useful product it would not be enabled by default.

Re:Recall: Stealing everything you've ever typed or viewed o... by ajross on Saturday June 01, 2024 @10:50AM (#40546189)
> It’s that it’s the OS putting an always on and enabled-by-default spyware on devices that are frequently shared

And I have to repeat: if Apple Computer had pushed the same product, but with a slide talking about how it was all locally encrypted and unextractable and tied to both the device and the user account, HN would be celebrating the attention to privacy even though macs too are "frequently shared". And the reasoning would be how strong the security engineering was around the process, because we love that stuff and we love macs.

MS doesn't get the same benefit of the doubt, and it leaks into the technical content of the argument, and that's wrong. And FWIW I'm mostly just handwaving the technical details. I mean, do we know for a fact that MS is *not* encrypting this with a TPM-managed key tied to the user account? I bet they are, honestly.

Re:Recall: Stealing everything you've ever typed or viewed o... by klabb3 on Saturday June 01, 2024 @12:06PM (#40546863)
> if Apple Computer had pushed the same product, […], HN would be celebrating the attention to privacy

I don’t believe so, at least not if it’s enabled-by-default.

> MS doesn't get the same benefit of the doubt

Apple doesn’t rely on benefit of the doubt because they are very clear about how the privacy of new products work (say Touch and Face ID), and Microsoft is not. I mean just look at this very thread, it’s super unclear how it works and interacts with other windows feature (some of which are premium) like fde/bitlocker and whether there’s telemetry/training. That obviously contributes to the “harsh” response. As it should.

Re:Recall: Stealing everything you've ever typed or viewed o... by kstrauser on Saturday June 01, 2024 @01:58PM (#40547782)
> I mean just look at this very thread, it’s super unclear how it works and interacts with other windows feature

I agree with you, but that’s not great evidence for your point. Bring up any random Apple feature and people will be quick to warn you about their misunderstandings of it. “Face ID means Apple has all our pictures now!” “Apple Keychain shares all your passwords with them!” Etc.

Re:Recall: Stealing everything you've ever typed or viewed o... by jacoblambda on Sunday June 02, 2024 @03:08AM (#40552031)
> bitlocker

Windows is actually pushing for bitlocker by default now. I believe new Windows 11 installs either are already or will soon start defaulting to enabling bitlocker across the board.

> telemetry/training

It's really just timer triggered screenshots + OCR + an SLM (small language model) running on device on a TPU/NPU, GPU, or other ONNX compatible device.

I'm generally super uncharitable about Microsoft since a lot of their stuff is a nasty black box with unclear security assumptions however with Recall, it seems like people are really jumping to conclusions without really even looking into what all it is.

This is a largely "unsophisticated" product made by bolting a bunch of more or less preassembled components and the bulk of which is open source.

- Screenshot + OCR is almost certainly Microsoft Powertoys Text Extractor (https://github.com/microsoft/PowerToys)

- The DB is sqlite but the system is probably just kernel-memory which is a local .NET application: https://github.com/microsoft/kernel-memory

- The SLM is Phi-3 which is open and designed primarily to run locally https://azure.microsoft.com/en-us/blog/introducing-phi-3-red...

- The actual underlying tech stack is DirectML (https://github.com/microsoft/DirectML) and ONNX (https://github.com/microsoft/onnxruntime).

----

So the data is intended to be encrypted at rest along with the rest of the OS, it's all run locally (which isn't a handwaivy thing, the tech is all very much capable of running locally) and if you don't have hardware capable of running it, it shouldn't be enabled in the first place.

My confusion with all of this is why Recall didn't start out as a PowerToys feature. It sounds like the exact type of internal "look at this cool little toy I built" thing that generally makes it into PowerToys but I'm assuming some exec ran with the opportunity and said "this is awesome, let's ship it with the OS and make it a highliner feature for our AI push" which is how we got here.

Re:Recall: Stealing everything you've ever typed or viewed o... by fbdab103 on Saturday June 01, 2024 @01:50PM (#40547712)
Absolutely not would I give Apple a free pass either. They can say all the nice things they want about protecting my privacy, but I do not trust any commercial entity will act in my best interest. Especially when they all have government requirements to hand over my data when a cop asks nicely.

We are speed running into a neuromancer dystopia where tech companies control every facet of our lives. Why would I be ok with them making it easier to monitor my every keystroke?

Re:Recall: Stealing everything you've ever typed or viewed o... by sleepybrett on Saturday June 01, 2024 @02:53PM (#40548167)
Spotlight already indexes all the text on your disk.
Re:Recall: Stealing everything you've ever typed or viewed o... by patrick451 on Sunday June 02, 2024 @10:51AM (#40554659)
> a lot of the responses here seem really uncharitable.

It's Microsoft. There no reason to extend any charity whatsoever when talking about this company.

Re:Recall: Stealing everything you've ever typed or viewed o... by JohnFen on Monday June 03, 2024 @12:47PM (#40564515)
> we'd all be crowing about how great it is

Not all of us, no.

Re:Recall: Stealing everything you've ever typed or viewed o... by rezonant on Friday May 31, 2024 @08:29PM (#40541708)
Thankfully it looks like they've already added support for Chrome, Firefox and a bunch of other browsers:

https://support.microsoft.com/en-us/windows/retrace-your-ste...

Re:Recall: Stealing everything you've ever typed or viewed o... by NewJazz on Friday May 31, 2024 @08:36PM (#40541752)
This is not something to be grateful for. They are normalizing spying by default.
Re:Recall: Stealing everything you've ever typed or viewed o... by rezonant on Saturday June 01, 2024 @12:46AM (#40542954)
I didn't say we should be grateful about that.

I'm saying that thankfully they are not using the threat of your guarded personal data being exposed because you want this feature but don't want to use Edge.

Re:Recall: Stealing everything you've ever typed or viewed o... by oefrha on Friday May 31, 2024 @08:35PM (#40541748)
That's what they say in marketing materials, but TFA claims to have dumped their database and was speaking from experience dissecting that. Hard to say which should be trusted.
Re:Recall: Stealing everything you've ever typed or viewed o... by wilsonnb3 on Friday May 31, 2024 @08:50PM (#40541840)
TFA is using a preview release of Windows modified to run on hardware that isn’t officially supported, I would lean towards trusting the marketing material on what will be supported at release.
Re:Recall: Stealing everything you've ever typed or viewed o... by hammyhavoc on Friday May 31, 2024 @10:01PM (#40542262)
"Thankful" for surveillance?
Re:Recall: Stealing everything you've ever typed or viewed o... by rezonant on Saturday June 01, 2024 @12:48AM (#40542971)
Thankful for not pushing Edge if you decide you want this feature. This feature is something the community has been independently creating for years.

Personally I don't think people should actually allow this type of feature. It's too much of a risk. But my point stands on its own, that at least they aren't creating an even more perverse incentive to use Edge, which they absolutely could have done, and seems the MO of the Microsoft today who would sacrifice all else to be able to say there's 1 or 2 more Edge or Bing users.

Re:Recall: Stealing everything you've ever typed or viewed o... by chuckadams on Saturday June 01, 2024 @04:00PM (#40548624)
It’s a local database that isn’t even synced. It’s as much “surveillance” as .bash_history is.

What it actually is however is hastily slapped together, enabled by default, and secured about as much as any other random system file, so MS doesn’t get a pass here, but they’re not twirling their mustaches like some would believe.

Re:Recall: Stealing everything you've ever typed or viewed o... by bitwize on Friday May 31, 2024 @08:43PM (#40541801)
Microsoft is still fighting the browser wars of the 90s. They're not going to give third-party browsers any quarter if they can avoid it.
Re:Recall: Stealing everything you've ever typed or viewed o... by friend_and_foe on Friday May 31, 2024 @10:41PM (#40542448)
> if you don't use our browser we will spy on you

Good god how more obvious could it be?

Anyone still using this software is a lost cause.

Re:Recall: Stealing everything you've ever typed or viewed o... by jmkni on Saturday June 01, 2024 @09:10AM (#40545455)
Most people just don’t care that much about tech (they have other shit going on) and will use whatever is put in front of them.

I think the tech community is responsible for keeping companies like MS in check and pushing back against literal spyware being normalised in operating systems.

Re:Recall: Stealing everything you've ever typed or viewed o... by gigel82 on Saturday June 01, 2024 @04:16PM (#40548756)
Presumably there's work needed from the app side for this integration, the OS component won't know what the app / user wants captured or not.