this post was submitted on 07 Jun 2024
454 points (97.5% liked)

Technology

60082 readers
4271 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots


founded 2 years ago
MODERATORS
 

When Microsoft CEO Satya Nadella revealed the new Windows AI tool that can answer questions about your web browsing and laptop use, he said one of the “magical” things about it was that the data doesn’t leave your laptop; the Windows Recall system takes screenshots of your activity every five seconds and saves them on the device. But security experts say that data may not stay there for long.

Two weeks ahead of Recall’s launch on new Copilot+ PCs on June 18, security researchers have demonstrated how preview versions of the tool store the screenshots in an unencrypted database. The researchers say the data could easily be hoovered up by an attacker. And now, in a warning about how Recall could be abused by criminal hackers, Alex Hagenah, a cybersecurity strategist and ethical hacker, has released a demo tool that can automatically extract and display everything Recall records on a laptop.

Dubbed TotalRecall—yes, after the 1990 sci-fi film—the tool can pull all the information that Recall saves into its main database on a Windows laptop. “The database is unencrypted. It’s all plain text,” Hagenah says.⁩ Since Microsoft revealed Recall in mid-May, security researchers have repeatedly compared it to spyware or stalkerware that can track everything you do on your device. “It’s a Trojan 2.0 really, built in,” Hagenah says, adding that he built TotalRecall—which he’s releasing on GitHub—in order to show what is possible and to encourage Microsoft to make changes before Recall fully launches.

you are viewing a single comment's thread
view the rest of the comments
[–] slimarev92 13 points 6 months ago (4 children)

Why on earth aren't they encrypting the database? It could have adressed much of the criticism but they just decided to leave the whole thing completely unprotected.

[–] esc27 9 points 6 months ago (2 children)

They encrypt the damn start menu and they cannot encrypt this?

[–] slimarev92 3 points 6 months ago
[–] [email protected] 3 points 6 months ago (1 children)
[–] esc27 2 points 6 months ago (1 children)

Yep. Trying to maintain a consistent startmenu for computer labs with Windows 11 is annoying.

The layout is stored in an encrypted file that cannot be editted directly. You have to manually setup the start menu on one profile then copy the file to all the others. This works fine for intial deployments, but is a massive pain if you need to add any other apps later.

The old powershell commandlet for importing layouts does not work in Win11. The old group policy settings don't work either. The actual DLL calls used by the end user to manually configuring the start menu are deliberatly coded to prevent being called from a script.

It is freaky how much work Microsoft has done to prevent scripting changes to the start menu.

The only officially supported method for an IT department to manage the start menu is intune, but microsoft's device licensing for intune is a mess out folks have yet to figure out.

[–] [email protected] 1 points 6 months ago

Ah, so user can't interfere with ads, hm?

[–] [email protected] 6 points 6 months ago (2 children)

Likely because there was too much CPU overhead decrypting and having the LLM query the Recall image database all dynamically

[–] [email protected] 2 points 6 months ago

In the grand scheme of things, the LLM is the bottleneck, not the decryption.

[–] slimarev92 1 points 6 months ago

I dunno, they could've kept some of it in-memory, it's just a bunch of plaintext.

[–] [email protected] 5 points 6 months ago

It requires full disk encryption doesn't it? If someone already has access to your account then they can access this data the same way you can. The new issue here is that this silos a load of private data in one easy to grab location. Users would have to set up the filters perfectly to prevent recall capturing anything more sensitive than what's already accessible to their account. This is in a world where many users are probably storing their passwords in a Word document on the desktop.

[–] Katana314 3 points 6 months ago

It could be that anything you encrypt has to have its encryption key in some place inaccessible to these same hacker tools. If your computer uses Bitlocker, for instance, you need to enter a 6-digit code each time you turn it on.

Best guess, they had such a high expectation of "convenience" for this feature that they couldn't justify any kind of security key. Which is still a dumb explanation, obviously.