It IS encrypted. Not well, but it's encrypted.

Now ransomware hackers can sell all your shit to someone else if you refuse to pay.

I doubt that. It’s preinstalled and enabled for personal users.

Even if it is enabled by default on pro/enterprise, there will probably be a group policy to disable it.

For the kids

Sony BMG copy protection rootkit scandal

Morons:

Sony BMG initially denied that the rootkits were harmful. It then released an uninstaller for one of the programs that merely made the program's files invisible while also installing additional software that could not be easily removed, collected an email address from the user and introduced further security vulnerabilities.

Very specific, but makes sense

It happens the same on android for some reason

Like 5-8 years ago the google assistant app was able to select and copy text from any app when invoked, I think it was called “now on tap”. Then because they’re google and they’re contractually obligated to remove features after some time, they removed this from the google app and integrated it in the pixel app switcher (and who cares if 99% of android users aren’t using a pixel, they say). The new implementation sucks, as it does ocr instead of just accessing the raw text…

It only works fine with us English and not with other languages. But maybe it’s ok as it seems that google’s development style is us-centric

Having worked on a product that actually did this, it's not as easy as it seems. There are many ways of drawing text on the screen.

GDI is the most common, which is part of the windows API. But some applications do their own rendering (including browsers).

Another difficulty, even if you could tap into every draw call, you would also need a way to determine what is visible on the screen and what is covered by something else.

Hey, yeah… why aren’t they just tapping the font rendering DLL?

…are they tapping the front rendering dll??

That's the thing, it doesn't really know what it's displaying. I can send a bunch of textboxes, but if they're hidden, or drawn off-screen, or underneath another element, then they're not actually displayed.

Text from OCR is one kind of match. Recall also runs visual comparisons with the image tokens stored.

What? Bitlocker key tied to MS account and mandatory? What's the point of encryption if the key isn't secret any more?

MS is obviously doing their absolute best to blame-shift here

There is not a single word in that article that says anything about blame shifting. That title was written by wired.com

Lol "if". This thing is going to be a massive target.

Someone has already demonstrated using an off-the-shelf infostealer to steal the Recall database from a test computer. It won't take any special skills or technology for this to be a problem.

sudon't please --pretty

Windows, pretending it can't read what you're typing in because you didn't click "show password":

First, false equivalency.

Second, we’re not okay with cookies and session being in a place that could leak — it’s why we’re doing everything possible to stop that from happening (I mean GDPR alone is one effect of this).

Third, the fact that you can’t see a difference between cookies, which actually can be secured via proper encryption and signing, and a literally unencrypted database driven by OCRed screenshots (taken every couple of minutes) that requires an opt-out and is a very small slippery slope to that data making its way back to Microsoft’s own servers for their own greedy pursuits….then I’m not sure what to tell you.

Recall is wrong. And it’s indefensible. Period.

If you think it’s okay, then feel free to open everything up to Microsoft of who you are and what you do on your Copilot+ PC. I, for one, among many, will choose to secure my information as best as possible, including never using another Microsoft product again, if at all possible. And I’ve already done so for myself.

browser data is a potential liability, sure, but you have tools to manage it. you can delete pages or entire websites, you can use private windows, you can purge history older than 6 months or something like that, and at least a few browsers have a "forget" button that wipes out the last two hours of history. similar deals with cookies and other data, and we've collectively decided the benefit of having browser data is worth the risk.

not so here. Recall is a record of everything you've ever done on your PC. you can't selectively delete things like you can with browser history, the app and website exclusion is only as good as whatever Recall is using to detect apps and websites, and you can't redact sensitive info after the fact. people are generally okay with browser history and data because they know they have fine-grained controls to manage it, controls Recall doesn't have