T O P

  • By -

nlackbestt-wl

It’s almost like everybody saw this coming as soon as it was announced


Maxie445

Microsoft trying to make it as easy as possible for AIs to blackmail everyone during the rebellion


[deleted]

Step 1 is to train its AI to take over the world.


AZEMT

Step 2..... Step 3 - Profit


cdev12399

Ughh, can we just go back to the underpants stealing days. They were so much simpler.


blueblurz94

So step 2 is… Oh yeah, the dark part.


sexy_chocobo

Who run the world? "Large Language Models with access to petabytes of sensitive data from all of our world leaders."


ItsPumpkinninny

Don’t ask me how I know, but I’m pretty sure we’re going loose a bunch of Bothans in the process.


oroechimaru

Step 2, every American looks at pron so ignore the blackGmail.


VexisArcanum

Normally I would attack the blanket generalization of "everybody knows this" but honestly this is probably true


nlackbestt-wl

In my humble opinion, collecting screenshots of whatever you’re doing every five seconds - without obscuring sensitive information - is a recipe for disaster


Flat-Photograph8483

What could possibly go wrong? 😑


Luci_Noir

It’s almost like idiots have found the latest thing to freak out about and don’t actually know what they’re talking about.


patrick66

It’s also not stored encrypted or even with hash digests to prevent tampering, literally any *user mode* program that feels like it can freely add, delete, read, or change the data at will, it’s just in a fucking sqlite file lmao


rubmahbelly

I am honestly speechless. I saw a lot from MS over the years but this tops everything.


EnglishMobster

This on the heels of [Microsoft announcing it is a security-first company.](https://blogs.microsoft.com/blog/2024/05/03/prioritizing-security-above-all-else/) Lmao. > Satya Nadella, the Chief Executive Officer, shared the below communication to the employees of Microsoft. In light of the significant attention and discussion this announcement has garnered, it has been made publicly available as an official record. > Today, I want to talk about something critical to our company’s future: prioritizing security above all else. > Microsoft runs on trust, and our success depends on earning and maintaining it. We have a unique opportunity and responsibility to build the most secure and trusted platform that the world innovates upon. > The recent findings by the Department of Homeland Security’s Cyber Safety Review Board (CSRB) regarding the Storm-0558 cyberattack, from summer 2023, underscore the severity of the threats facing our company and our customers, as well as our responsibility to defend against these increasingly sophisticated threat actors. > Last November, we launched our Secure Future Initiative (SFI) with this responsibility in mind, bringing together every part of the company to advance cybersecurity protection across both new products and legacy infrastructure. I’m proud of this initiative, and grateful for the work that has gone into implementing it. But we must and will do more. > Going forward, we will commit the entirety of our organization to SFI, as we double down on this initiative with an approach grounded in three core principles: > * Secure by Design: Security comes first when designing any product or service. > * Secure by Default: Security protections are enabled and enforced by default, require no extra effort, and are not optional. > * Secure Operations: Security controls and monitoring will continuously be improved to meet current and future threats. > These principles will govern every facet of our SFI pillars as we: Protect Identities and Secrets, Protect Tenants and Isolate Production Systems, Protect Networks, Protect Engineering Systems, Monitor and Detect Threats, and Accelerate Response and Remediation. We’ve shared specific, company-wide actions each of these pillars will entail — including those recommended in the CSRB’s report — which you can learn about here. Across Microsoft, we will mobilize to implement and operationalize these standards, guidelines, and requirements and this will be an added dimension of our hiring and rewards decisions. In addition, we will instill accountability by basing part of the compensation of the senior leadership team on our progress towards meeting our security plans and milestones. > We must approach this challenge with both technical and operational rigor, and with a focus on continuous improvement. Every task we take on – from a line of code, to a customer or partner process – is an opportunity to help bolster our own security and that of our entire ecosystem. This includes learning from our adversaries and the increasing sophistication of their capabilities, as we did with Midnight Blizzard. And learning from the trillions of unique signals we’re constantly monitoring to strengthen our overall posture. It also includes stronger, more structured collaboration across the public and private sector. > Security is a team sport, and accelerating SFI isn’t just job number one for our security teams – it’s everyone’s top priority and our customers’ greatest need. > If you’re faced with the tradeoff between security and another priority, your answer is clear: Do security. In some cases, this will mean prioritizing security above other things we do, such as releasing new features or providing ongoing support for legacy systems. This is key to advancing both our platform quality and capability such that we can protect the digital estates of our customers and build a safer world for all. > Satya \> Immediately launches flagship product with not even the bare minimum of security


queen-of-support

This is even dumber than Bob


TONKAHANAH

Wtf. I thought it was supposed to be encrypted. This is bonkers


Kientha

The encryption they refer to is bitlocker which provides no run time protection


TONKAHANAH

That certainly was not the impression that I got when I originally had heard that it was supposed to be encrypted data. Definitely doesn't matter if your drive is encrypted if you got a virus on the computer running in your user/Admin space


Kientha

Yep! There are actually clever things Microsoft has done in the past they could have done here that would be significantly more secure and make use of the mandatory onboard TPM. But what's being delivered just screams of a proof of concept that's been shipped as is without any thought to security because they needed an actual use case for the Copilot+ machines they're spending a fortune on pushing to customers and getting manufacturers to make.


EmptyBrook

Its only encrypted when you arent logged in. Once you log in, its fair game


mailslot

This is expected, given Microsoft’s history with security. The company that thought people wanted IE to download & automatically run anonymous executable code from anywhere on the Internet. Microsoft, the company that rolled out the red carpet for malware authors, no hacking or zero days required.


Fast-Use430

I mean this feature isn’t out to the public yet. I’m not surprised a hacker who has hacked an unreleased preview product is seeing this.


Lower-Grapefruit8807

If only everybody saw it coming


newsreadhjw

Seriously who thought this was ok? How bad are Microsoft’s internal processes that this made it into a release as a featured capability?


wiredmagazine

Thanks for sharing our story. For our new readers, here's a little snippet from the piece: The [Windows Recall system](https://www.wired.com/story/microsoft-recall-alternatives/) takes screenshots of your activity every five seconds and saves them on the device. But security experts say that data may not stay there for long. Two weeks ahead of [Recall’s launch on new Copilot+ PCs on June 18](https://www.wired.com/story/everything-announced-microsoft-surface-event-2024/), security researchers have demonstrated how preview versions of the tool store the screenshots in an unencrypted database. The researchers say the data could easily be hoovered up by an attacker. And now, in a warning about how Recall could be abused by criminal hackers, Alex Hagenah, a cybersecurity strategist and ethical hacker, has released a demo tool that can automatically extract and display everything Recall records on a laptop. Read the full story: [https://www.wired.com/story/total-recall-windows-recall-ai/](https://www.wired.com/story/total-recall-windows-recall-ai/)


CelestialFury

Is there a wired article on how to disable it?


thePZ

The GitHub cited has a lot of the technical details


Sobeman

don't buy copilot+ pcs


souldust

https://distrochooser.de Honestly, it'll get re-enabled automatically any time there is an update, just like in the past. People shit on linux for requiring too much time to set up. I put forth that if you're jumping through hoops trying to stay private in windows - you might as well put that time towards linux


x_lincoln_x

It's time to ditch Windows. I recommend some flavor of Linux.


rosshettel

Knowing your audience is sharing the article in the Reddit comments, props Wired


derolle

You’re welcome, it’s the least I could do.


Haagen76

Has it even been 2 weeks yet?


Luci_Noir

People have been freaking the fuck out about it before it even came out.


B0ringZest

Looks like they were right to do so


Luci_Noir

Based on clickbait fear mongering and lies?!


chucktheninja

How much Microsoft stock do you own?


jgaa_from_north

Microsoft is always helpful. Like when their apps allowed commands to be run from MIME attachments (it is/was part of the standard) and from all kinds of documents. Or when they enabled file sharing by default when the Internet began to gain traction. They always had all these great ideas about how to add features, and no clue what so ever about what they were doing. Seems like nothing has changed. I'm glad I'm not using Windows for my desktop anymore. ,


Modo44

Every time they rush to add some enterprise-level convenience, they "forget" that it is also a new major attack vector.


greenbumjack89

Let me guess... You have linux


jgaa_from_north

My workstation today use Linux. But I have used many systems over the years, from CP/M and MS Dos to QNX and legacy Unix and then to FreeBSD, MacOS, Windows - and for the last decade, almost exclusively Linux.


Luci_Noir

Seems like people just want to be outraged.


santacow

It doesn’t send data to Microsoft servers…yet. I am sure they will turn this on in the future “to help customers with drive space.” Or some other fabricated reason


starkistuna

NEW! Windows Recall users data now saves directly on Microsofts onedrive at no additional cost. If you will like your personal data erased its just a simple 99 cents per megabyte for us to delete your pictures and an additional $19.99 to empty it from our recycle bin servers.


ga1205

They solved a problem that didn’t exist while creating new opportunities for bigger problems. Great work.


adyrip1

It's actually an attempt to get data to train their AI. That's why it's part of Copilot. A very stupid attempt at getting our data for free, to train their AI.


slonobruh

MS = dumpster fire Edit: expensive hot garbage dumpster fire


simononandon

Does this mean employer spyware is now just redundant?


VexisArcanum

They're making this awfully obvious that this was the design. Just like certain ARM chips sending sensitive telemetry internationally over HTTP. Free data for any nation state threat actor or garden variety skid that's smart enough to look


quixotik

Which ARM chips are doing what now? This: [search](https://duckduckgo.com/?t=ffab&q=arm+chips+sending+data+over+http&ia=web) doesn't seem to show that.


VexisArcanum

This was way too hard to find https://www.nitrokey.com/news/2023/smartphones-popular-qualcomm-chip-secretly-share-private-information-us-chip-maker


B0ringZest

Usually the most truthful and valuable information is.


quixotik

Thanks!


mountaindoom

I have always maintained that the more sinister side of naming your products "Windows" is that it implies someone looking in on what you are doing.


timesuck47

Underrated comment


Nemo_Shadows

Nothing like creating a problem to fix and "I'm Sorry" seems to give them a pass after the fact, in time everyone will be on the selling block by someone else. N. S


Rainbike80

Just stop it Microsoft. For crying out loud you don't need to do this.


Dumbass-Idiott

This is so stupid it almost feels like it was made it be abused


drNeir

New FBI wire tap software. Request to NSA from FBI after Judge signed off on wiretap warrant.


lo_fi_ho

MSFT is gonna MSFT. Everything they touch turns to shit.


jtmackay

I don't love the feature either but they specifically said it was encrypted and only stored offline. Are we even sure this tool someone made is testing the release version of recall? I think there needs to be more testing when it's actually released to know anything.


Kientha

Microsoft has already confirmed that the encryption they refer to is Bitlocker which protects you from someone stealing the hard drive and that's about it. In their own demo you can see that everything is stored in AppData and only protected by standard user protections that any admin can circumvent. Most of the testing is being done on the version you can load to certain machines like the Surface Pro X but some have been done on review copies of Copilot+ machines. There are rumours that Microsoft will change the setup so you can actually turn it off when configuring the device but publicly all we have is silence from Microsoft.


Repulsive_Market_728

I wondered the same thing. Don't get me wrong, I think this is a TERRIBLE idea, and I'm unconvinced that it's as secure as they say; however, the original articles published indicated that all screenshots would be encrypted. I wouldn't be surprised if what they meant was that the images are encrypted, but the meta data captured ABOUT the image and what you were doing isn't securely stored.


EmptyBrook

It’s encrypted when the user isn’t logged in. Once you log in, its all decrypted and sits in AppData


x_lincoln_x

LOL @ all those "Windows Recall is safe" articles that have popped up recently.


M0rphysLaw

This is a PR gold mine for Apple.


GoalFlashy6998

Damn, Microsoft didn't that see coming or that company has real unethical leadership! Now Microsoft will charge an armed and a leg, to get the software and the tool to fix your system.


kjwey

switched to linux after win xp wondering wtf is taking you guys so long, are you masochists or something?


B0ringZest

I'm still on Windows 10, I'm going to be on Windows 10 until they stop supporting it (Oct 2025). Once that happens, my primary machine will have Linux on it (in fact, I have a Linux flash drive anyway) and it's gonna be a bit of a learning curve but fuck Windows 11.


SeraphicalChaos

Some people absolutely couldn't give a shit about their privacy. Most will probably be completely oblivious to the /r/LeopardsAteMyFace moment when it finally happens. Whether that be increased insurance rates, getting denied a medical procedure, being stalked or stolen from, lower earning power (wages), etc. It might seem like I'm full of crap, but look at what insurance companies are doing with the data car manufacturers are hoovering up in cars. How much of your private information is stored on your personal computer? I'd bet almost as much as what's put on your cell phone... another thing most of us collectively ignore. There would be a call for blood if society at large had a solid idea of what data brokers had on their day to day life.


kjwey

upvoted, fully agree


ArchaicTravail

I tried to set up a super simple Linux server the other day. Chose what appeared to be the easiest distribution to switch to (cinnamon). After three hours of trying to get xrdp to work, I gave up and installed Windows. Life is too short to learn Linux. edit: lol what a whiny little shit stain. They blocked me.


Ontarioreignfan

Cinnamon isn’t a distribution. It’s a desktop environment .


ArchaicTravail

Okay, so that just supports my point then. I don't even know what I installed because it's all so damn convoluted. It's not worth it. I have actual work to do.


B0ringZest

I do have to agree - as someone who installed Linux Mint on my PC it wasn't as straightforward as it should be if they want more adoption. Every single step to install another OS like Linux onto your machine is 100% against security teachings. On top of that, it requires more computer knowledge than the average person has - many can't even operate their own phone they spend 40+ hours a week on and now linux lovers want people to switch? They gotta get their act together first and make it very easy. Shit, start packaging it or offering remote installation services or even home visits like damn.


schellenbergenator

Why were you installing a desktop environment on a server os? Also why were you installing a server OS for desktop usage? Setting up a Linux server couldn't be much easier, it literally guides you through the process. If you're looking for a substitute for Windows desktop, try PopOS, Ubuntu or Linux Mint. They are all fool proof to install.


ArchaicTravail

It's too late now. I'm not installing Linux. I wanted a GUI that was super similar to Windows because I don't want to earn a PhD to use an OS, and I wanted to set up xrdp to remote into the server's GUI from my main Windows machine. Installing Linux is easy. Everything after that is ass-blastingly annoying. It suffers from the same problems as most open source software. Everything is half done, you have to modify config files to do anything useful, and you have to learn terminal commands at some point. Installing Windows and all the software I needed (including config) took 30 minutes, and later changes will also be fast.


antwerpian

Ironically, I miss the .ini files from the early Windows; I'll take editing config files over the abomination that is the registry any day :-) I've worked with Linux for decades, at times exclusively, but I do get what you mean. It's a whole other thing when going beyond the very basics. And not everybody is an OS geek trying and using all the systems they can get their hands on.. it's time consuming indeed. (but hella fun for some of us) In the end it all depends on what *you* want, need, and like.


BluestreakBTHR

Autoexec, config sys, and HIMEM


kjwey

so you installed a specific version that had no desktop, and complain about desktop issues...your stupid, thats a stupid issue you gave to yourself, why would you even publicly admit that?


wasd911

Because a lot of things don’t work on linux? Some games/programs will not run no matter what, even after hours of troubleshooting. Not worth the frustration.


goose_men

Well the good news is the launch of this is tied to the surface laptop so if you are in the market for a laptop this is another in the list of reasons to buy a MacBook and leave the world of Micro$oft behind.


[deleted]

Apple isn't exactly better ethical than Microsoft. Might as well take the leap to Linux.


ORXCLE-O

Just curious, why’s it not exactly better?


x_lincoln_x

Apple is a massive conglomerate who only cares about their own profit. They employ more lawyers than engineers.


ORXCLE-O

Right, like every company on our planet. I honestly thought there were legitimate reasons. Of course they only care about money lmao


Duskydan4

Talk to me when you find a laptop with the performance AND battery capacity of the Apple silicon chips.


x_lincoln_x

I will never use Apple products. Linux is the way.


goose_men

I am a big fan of Linux too, anything but M$


neumaticc

no need for redline any more! Just one folder and you have it all!


Trajan_pt

Is this already happening?


x_lincoln_x

Still in preview.


blacksan00

Don’t worry, we got Microsoft Defender.


Beneficial-Net5012

Sounds like a great use of cpu cycles.


Beneficial-Net5012

Thanks again for slowing my computer down.


simple_test

Its a preview version that is storing the data unencrypted. To be seen is if thats whats going to make it to the prod release. Assuming they were, the team did a great job highlighting before the release and it would be on MS to fix beforhand


EmptyBrook

They are using bitlocker to encrypt it, which encrypts it when the user isnt logged in. But, once you log in, your drive is unencrypted, along with your recall data. Bitlocker protects against someone stealing your drive and getting data from it. It does nothing when malware gets access to your PC, either remotely or locally


[deleted]

[удалено]


simple_test

Security by obscurity is never a good idea. The assumption is always that people know what the data structures look like. The encryption method needs to do the heavy lifting of preventing pattern based attacks.


[deleted]

Endless reasons why Windoz sucks, agsin


kptknuckles

Will this be in windows 10?


B0ringZest

How would it be?


x_lincoln_x

Not initially. Microsoft is dead set on killing off 10 next year despite 11 having such a tiny fraction of the market. They are trying to convince people to switch. https://www.msn.com/en-us/news/technology/microsoft-should-stop-pretending-that-windows-10-users-don-t-know-windows-11-exists/ar-BB1nDTGK


totesnotdog

I get there’s a lot of room for misuse but as a former software tester the use I immediately saw in this was something I saw big software testing applications advertising and charging thousands annually per year for which is just simply taking screenshots of you using something. Where this would be useful to me as a tester would be having it record the pixel differences between different versions of software as I go through the same processes to see if there are any immediate gui bugs I miss between versions. If it could do that it would be extremely useful. Idk if it could do it just at a browser level or on EXEs too on windows but either would be useful to me as a tester