Defiant Microsoft pushes ahead with controversial Recall – tho as an opt-in
(2024/06/07)
- Reference: 1717789254
- News link: https://www.theregister.co.uk/2024/06/07/microsoft_recall_changes/
- Source link:
Microsoft is not giving up on its controversial Windows Recall, though says it will give customers an option to opt in instead of having it on by default, and will beef up the security of any data the software stores.
Recall, for those who missed the [1]dumpster fire , was [2]announced on May 20 as a "feature" on forthcoming Copilot+ Windows PCs. It takes a snapshot of whatever is on the user's screen every few seconds. These images are stored on-device and analyzed locally by an AI model, using OCR to extract text from the screen, to make past work searchable and more accessible.
The [3]ultimate goal for Recall is to record nearly everything the user does on their Windows PC, including conversations and app usage, as well as screenshots, and present that archive in a way that allows the user to remind themselves what they were doing at some point in the past and pull up relevant files and web pages to interact with again. The archive can be searched using text, or the user can drag a control along a timeline bar to recall activities.
[4]
But security testers have raised doubts about the safety of recorded information and have developed [5]tools that can extract these snapshots and whatever sensitive information they contain. The data is for now stored as an easy to access non-encrypted SQLite database in the local file system.
[6]
[7]
This comes at a time when Microsoft is being [8]roundly hammered for its vulnerabilities and [9]poor security – and now the OS maker wants everyone to trust it more than ever. Recall is a boon for cyber-crooks as well as lawyers requesting discovery of someone's computer, and a nightmare for anyone handling medical and other sensitive records.
As Kevin Beaumont, director of emerging threats for Arcadia Group (and a former Microsoft threat analyst) put it in a personal blog post, Recall " [10]fundamentally undermines Windows security."
[11]
And the more people looked, the worse things got for Recall. James Forshaw, a security researcher with Google's Project Zero, wrote an [12]analysis on Monday in which he explored how one might get access to the Recall database by gaining administrative privileges.
Two days later, he amended his post to observe that privilege escalation isn't necessary as a user can simply deploy a readily available token that provides access to the Recall database. "Turns out I was wrong about Recall being secure," he wrote.
[13]Microsoft Research chief scientist has no issue with Windows Recall
[14]Microsoft updates accessibility feature Voice Access to auto-restart
[15]Microsoft expects further concessions for Teams amid EC antitrust probe
[16]The definition of an AI PC is now even muddier, helping no-one – not even AIs
Finally, after three weeks of withering criticism and [17]acting as if everything is fine, Microsoft has decided to change a few things.
"Even before making Recall available to customers, we have heard a clear signal that we can make it easier for people to choose to enable Recall on their Copilot+ PC and improve privacy and security safeguards," said Pavan Davuluri, corporate VP of Windows and Devices, in a [18]blog post on Friday.
"With that in mind we are announcing updates that will go into effect before Recall (preview) ships to customers on June 18."
[19]
Davuluri said that henceforth Recall will be offered as an opt-in service during the set-up process for Copilot+ PCs rather than as a default. In addition, Microsoft will require enrollment in [20]Windows Hello to enable Recall, as well as proof of presence when viewing your timeline or searching in the app.
Finally, Davuluri said that Microsoft is adding "additional layers of data protection including 'just in time' decryption protected by [21]Windows Hello Enhanced Sign-in Security (ESS) so Recall snapshots will only be decrypted and accessible when the user authenticates. In addition, we encrypted the search index database."
Was there no one at Microsoft who looked at Recall and said: This really sucks [22]OUR VIEW
"We are on a journey to build products and experiences that live up to our company mission to empower people and organizations to achieve more, and are driven by the critical importance of maintaining our customers’ privacy, security and trust," said Davuluri.
"As we always do, we will continue to listen to and learn from our customers, including consumers, developers and enterprises, to evolve our experiences in ways that are meaningful to them."
Maybe next time, the listening and learning part will occur prior to the product release announcement.
"Obviously, I recommend you do not enable Recall, and you tell your family not to enable it too," said Beaumont, in response to the Microsoft announcement, in a Mastodon [23]post . ®
Get our [24]Tech Resources
[1] https://www.theregister.com/2024/05/22/windows_recall/
[2] https://blogs.microsoft.com/blog/2024/05/20/introducing-copilot-pcs/
[3] https://support.microsoft.com/en-us/windows/retrace-your-steps-with-recall-aa03f8a0-a78b-4b3e-b0a1-2eb8ac48701c
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZmODA32I2zNRPMmDxkRutAAAANc&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[5] https://github.com/xaitax/TotalRecall
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZmODA32I2zNRPMmDxkRutAAAANc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZmODA32I2zNRPMmDxkRutAAAANc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2024/06/04/pentagon_doubling_down_on_microsoft/
[9] https://www.theregister.com/2024/04/03/cisa_microsoft_exchange_online_china_report/
[10] https://doublepulsar.com/how-the-new-microsoft-recall-feature-fundamentally-undermines-windows-security-aa072829f218
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZmODA32I2zNRPMmDxkRutAAAANc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[12] https://www.tiraniddo.dev/2024/06/working-your-way-around-acl.html
[13] https://www.theregister.com/2024/06/06/microsoft_research_recall/
[14] https://www.theregister.com/2024/06/07/microsoft_updates_voice_access/
[15] https://www.theregister.com/2024/06/05/microsoft_expects_further_concessions_for/
[16] https://www.theregister.com/2024/06/05/ai_pc_confusion/
[17] https://www.theregister.com/2024/06/06/microsoft_research_recall/
[18] https://blogs.windows.com/windowsexperience/2024/06/07/update-on-the-recall-preview-feature-for-copilot-pcs/
[19] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZmODA32I2zNRPMmDxkRutAAAANc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[20] https://support.microsoft.com/en-us/windows/configure-windows-hello-dae28983-8242-bb2a-d3d1-87c9d265a5f0
[21] https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/windows-hello-enhanced-sign-in-security
[22] https://www.theregister.com/2024/05/25/microsoft_build_kettle/
[23] https://cyberplace.social/@GossiTheDog/112576331591866691
[24] https://whitepapers.theregister.com/
Recall, for those who missed the [1]dumpster fire , was [2]announced on May 20 as a "feature" on forthcoming Copilot+ Windows PCs. It takes a snapshot of whatever is on the user's screen every few seconds. These images are stored on-device and analyzed locally by an AI model, using OCR to extract text from the screen, to make past work searchable and more accessible.
The [3]ultimate goal for Recall is to record nearly everything the user does on their Windows PC, including conversations and app usage, as well as screenshots, and present that archive in a way that allows the user to remind themselves what they were doing at some point in the past and pull up relevant files and web pages to interact with again. The archive can be searched using text, or the user can drag a control along a timeline bar to recall activities.
[4]
But security testers have raised doubts about the safety of recorded information and have developed [5]tools that can extract these snapshots and whatever sensitive information they contain. The data is for now stored as an easy to access non-encrypted SQLite database in the local file system.
[6]
[7]
This comes at a time when Microsoft is being [8]roundly hammered for its vulnerabilities and [9]poor security – and now the OS maker wants everyone to trust it more than ever. Recall is a boon for cyber-crooks as well as lawyers requesting discovery of someone's computer, and a nightmare for anyone handling medical and other sensitive records.
As Kevin Beaumont, director of emerging threats for Arcadia Group (and a former Microsoft threat analyst) put it in a personal blog post, Recall " [10]fundamentally undermines Windows security."
[11]
And the more people looked, the worse things got for Recall. James Forshaw, a security researcher with Google's Project Zero, wrote an [12]analysis on Monday in which he explored how one might get access to the Recall database by gaining administrative privileges.
Two days later, he amended his post to observe that privilege escalation isn't necessary as a user can simply deploy a readily available token that provides access to the Recall database. "Turns out I was wrong about Recall being secure," he wrote.
[13]Microsoft Research chief scientist has no issue with Windows Recall
[14]Microsoft updates accessibility feature Voice Access to auto-restart
[15]Microsoft expects further concessions for Teams amid EC antitrust probe
[16]The definition of an AI PC is now even muddier, helping no-one – not even AIs
Finally, after three weeks of withering criticism and [17]acting as if everything is fine, Microsoft has decided to change a few things.
"Even before making Recall available to customers, we have heard a clear signal that we can make it easier for people to choose to enable Recall on their Copilot+ PC and improve privacy and security safeguards," said Pavan Davuluri, corporate VP of Windows and Devices, in a [18]blog post on Friday.
"With that in mind we are announcing updates that will go into effect before Recall (preview) ships to customers on June 18."
[19]
Davuluri said that henceforth Recall will be offered as an opt-in service during the set-up process for Copilot+ PCs rather than as a default. In addition, Microsoft will require enrollment in [20]Windows Hello to enable Recall, as well as proof of presence when viewing your timeline or searching in the app.
Finally, Davuluri said that Microsoft is adding "additional layers of data protection including 'just in time' decryption protected by [21]Windows Hello Enhanced Sign-in Security (ESS) so Recall snapshots will only be decrypted and accessible when the user authenticates. In addition, we encrypted the search index database."
Was there no one at Microsoft who looked at Recall and said: This really sucks [22]OUR VIEW
"We are on a journey to build products and experiences that live up to our company mission to empower people and organizations to achieve more, and are driven by the critical importance of maintaining our customers’ privacy, security and trust," said Davuluri.
"As we always do, we will continue to listen to and learn from our customers, including consumers, developers and enterprises, to evolve our experiences in ways that are meaningful to them."
Maybe next time, the listening and learning part will occur prior to the product release announcement.
"Obviously, I recommend you do not enable Recall, and you tell your family not to enable it too," said Beaumont, in response to the Microsoft announcement, in a Mastodon [23]post . ®
Get our [24]Tech Resources
[1] https://www.theregister.com/2024/05/22/windows_recall/
[2] https://blogs.microsoft.com/blog/2024/05/20/introducing-copilot-pcs/
[3] https://support.microsoft.com/en-us/windows/retrace-your-steps-with-recall-aa03f8a0-a78b-4b3e-b0a1-2eb8ac48701c
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZmODA32I2zNRPMmDxkRutAAAANc&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[5] https://github.com/xaitax/TotalRecall
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZmODA32I2zNRPMmDxkRutAAAANc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZmODA32I2zNRPMmDxkRutAAAANc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2024/06/04/pentagon_doubling_down_on_microsoft/
[9] https://www.theregister.com/2024/04/03/cisa_microsoft_exchange_online_china_report/
[10] https://doublepulsar.com/how-the-new-microsoft-recall-feature-fundamentally-undermines-windows-security-aa072829f218
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZmODA32I2zNRPMmDxkRutAAAANc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[12] https://www.tiraniddo.dev/2024/06/working-your-way-around-acl.html
[13] https://www.theregister.com/2024/06/06/microsoft_research_recall/
[14] https://www.theregister.com/2024/06/07/microsoft_updates_voice_access/
[15] https://www.theregister.com/2024/06/05/microsoft_expects_further_concessions_for/
[16] https://www.theregister.com/2024/06/05/ai_pc_confusion/
[17] https://www.theregister.com/2024/06/06/microsoft_research_recall/
[18] https://blogs.windows.com/windowsexperience/2024/06/07/update-on-the-recall-preview-feature-for-copilot-pcs/
[19] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZmODA32I2zNRPMmDxkRutAAAANc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[20] https://support.microsoft.com/en-us/windows/configure-windows-hello-dae28983-8242-bb2a-d3d1-87c9d265a5f0
[21] https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/windows-hello-enhanced-sign-in-security
[22] https://www.theregister.com/2024/05/25/microsoft_build_kettle/
[23] https://cyberplace.social/@GossiTheDog/112576331591866691
[24] https://whitepapers.theregister.com/
Re: Camel and straw
Like a badger
I wish it would be so. But corporate users (a) can probably use policies, standard builds and third party tools to cut out the cancer that is Recall, and (b) even if they can't, don't have the courage to go Linux for the desktop.
Imagine a suit stamping on a human face forever. That's Microsoft.
Won't someone think of the conspiracy theories?
kend1
Where did the idea for Recall come from? Follow the money...
https://www.theregister.com/2024/06/04/pentagon_doubling_down_on_microsoft/
"The Department of Defense is one of the largest purchasers of cybersecurity services," Wyden and Schmitt wrote. "Through its buying power, DoD's strategies and standards have the power to shape corporate strategies that result in more resilient cybersecurity services."
Bait and switch
Dan 55
There's no way to retro fit file encryption and TPM and Hello integration into Recall and QA that between now and its launch in two weeks. None.
Even assuming they started three weeks ago on the same day that everyone's criticism first started, the chances are still none.
I get the feeling we have been played.
Camel and straw
This [1] interesting article postulates that Microsoft has lost the trust of its users and could see an erosion of its user base because of this. I've been saying for years that Microsoft doesn't care about what Windows users want and is only interested in adding features that pump-up its bottom line. This Recall thing merely throws it up into everyone's face and has led to people thinking about fleeing the platform for...Linux Mint.
[1]: https://www.windowscentral.com/software-apps/windows-11/microsoft-has-lost-trust-with-its-users-windows-recall-is-the-last-straw