News for hackers. Stuff that matters.

A comment on Microsoft Will Switch Off Recall by Default After Security Backlash. Parent comment

Re:Microsoft Will Switch Off Recall by Default After Securit... by Analemma_ on Friday June 07, 2024 @01:40PM (#40610944)
Yeah, I think this entire debate is uninformed hysteria and manufactured outrage. "If an attacker has administrator access, they can see everything you have done on your computer!". OK? That has literally always been the case? "Attacker is root" is game over and always has been. The original writeup from DoublePulsar tried to justify that Recall is somehow different from other such scenarios, but I found it totally unconvincing.

I think it's the right move to have it off by default, but I'm just not convinced by the outrage here.

[ Parent | on HN ]
Re:Microsoft Will Switch Off Recall by Default After Securit... by Tool_of_Society on Friday June 07, 2024 @01:51PM (#40611051)
Browser history doesn't show my passwords, everything I typed out and did on the machine.

In comparison browser history is nothing.

[ Parent | on HN ]
Re:Microsoft Will Switch Off Recall by Default After Securit... by sanktanglia on Friday June 07, 2024 @02:10PM (#40611270)
You can get cookies/tokens from chrome databases so its the equivalent to passwords in alot of cases
[ Parent | on HN ]
Re:Microsoft Will Switch Off Recall by Default After Securit... by Analemma_ on Friday June 07, 2024 @01:56PM (#40611119)
You’re missing the point. An attacker can only see the passwords in your Recall database if they have root, but if they have root there are (and always have been) a thousand other ways they can get your passwords. There is no new attack vector being introduced by Recall.
[ Parent | on HN ]
Re:Microsoft Will Switch Off Recall by Default After Securit... by smaudet on Friday June 07, 2024 @03:43PM (#40612189)
Another big, big difference, anybody, not just some black-hat pro with a long kill chain of zero-days, has a fantastic source of data to exfiltrate.

Perhaps you didn't note before, or are one yourself, but this includes e.g. abusive spouses. Sure, maybe the abusive spouse could hire a black hat, but this is very different to a drunk low-life wife-beater casually snooping through "recall".

It might not be a "new" attack vector, but its absolutely a complete degradation to any computer security.

[ Parent | on HN ]
Re:Microsoft Will Switch Off Recall by Default After Securit... by morder on Friday June 07, 2024 @02:13PM (#40611298)
One difference is that you can get root access after the fact and get however much prior data Recall recorded vs only going forward.
[ Parent | on HN ]
Re:Microsoft Will Switch Off Recall by Default After Securit... by fh9302 on Friday June 07, 2024 @02:21PM (#40611399)
It is possible to access to Recall database without admin access.

https://x.com/GossiTheDog/status/1798832390070276500

[ Parent | on HN ]
Re:Microsoft Will Switch Off Recall by Default After Securit... by sgent on Friday June 07, 2024 @03:20PM (#40611975)
RTA, Microsoft announced changes to the security model to prevent that.
[ Parent | on HN ]
Re:Microsoft Will Switch Off Recall by Default After Securit... by fh9302 on Friday June 07, 2024 @03:31PM (#40612075)
I did read the article. The person I'm replying to claims the entire debate was "uninformed hysteria", which means they thought the previous security model already required admin.
[ Parent | on HN ]
Re:Microsoft Will Switch Off Recall by Default After Securit... by Benedicht on Friday June 07, 2024 @02:07PM (#40611237)
If an attacker got root with recall they might not need to wait the user to type their password and risk detection. The information they want to know might be already in the recall database.
[ Parent | on HN ]
Re:Microsoft Will Switch Off Recall by Default After Securit... by mostlysimilar on Friday June 07, 2024 @01:42PM (#40610967)
Recall FEELS like being watched. Your browser history does not.
[ Parent | on HN ]
Re:Microsoft Will Switch Off Recall by Default After Securit... by listenallyall on Friday June 07, 2024 @02:22PM (#40611416)
To be clear, I am not in favor of Recall or dismissing its intrusiveness. However, the correct comparison is not just "browser history". Google is also tracking your search history, passwords (built-in password manager), location history (Google Maps), ad clicks, and more. All-in, it's a LOT of data.
[ Parent | on HN ]
Re:Microsoft Will Switch Off Recall by Default After Securit... by mostlysimilar on Friday June 07, 2024 @04:13PM (#40612495)
I'm with you -- I avoid Google products for the reasons you listed and am staunchly anti-surveillance capitalism. I just meant to say that even for a person with my very plugged-in perspective on these topics, Google's violations of my privacy still don't feel quite as invasive as Recall feels, even if on paper it's just as egregious and dangerous.
[ Parent | on HN ]
Re:Microsoft Will Switch Off Recall by Default After Securit... by shermantanktop on Friday June 07, 2024 @02:30PM (#40611487)
In a typical bigcorp environment, laptops are loaded with silently installed spyware. Certainly equivalent to taking a screenshot every second or an always-on keylogger.

The horse is out of the barn for many people during work hours. But in the OS and on by default is a different story!

[ Parent | on HN ]
Re:Microsoft Will Switch Off Recall by Default After Securit... by amusingimpala75 on Friday June 07, 2024 @02:23PM (#40611428)
Except that before today you didn’t even need admin for access to the database, any process that is allowed to read things could access the Recall database.
[ Parent | on HN ]
Re:Microsoft Will Switch Off Recall by Default After Securit... by adammarples on Saturday June 08, 2024 @01:16PM (#40618960)
Someone with root access can't see anything that has been deleted, or the contents of secure web pages I've visited, like my banks, doctor, or email. Very different.
[ Parent | on HN ]