this post was submitted on 04 Jun 2024

662 points (98.5% liked)

Technology

59572 readers

3219 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each another!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 1 year ago

MODERATORS

662

xaitax/TotalRecall: This tool extracts and displays data from the Recall feature in Windows 11, providing an easy way to access information about your PC's activity snapshots. (github.com)

submitted 5 months ago by salarua@sopuli.xyz to c/technology@lemmy.world

83 comments fedilink hide all child comments

this rootless Python script rips Windows Recall's screenshots and SQLite database of OCRed text and allows you to search them.

(page 2) 36 comments

sorted by: hot top controversial new old

[–] Everyday3671@lemmy.world 6 points 5 months ago

That was quick.

[–] AlexisFR@jlai.lu 2 points 5 months ago (2 children)

Is this thing even a thing? I see lots of discussion about it, but not real proof it was enabled across the board on all win 11 computers.

[–] sugartits@lemmy.world 3 points 5 months ago

Yes. It's very very real and is just a typical Microsoft bullshit move.

https://x.com/GossiTheDog/status/1798812975735996772

[–] salarua@sopuli.xyz 3 points 5 months ago

it's on "Copilot+" PCs (i.e. ARM-based with an NPU)

[+] csm10495@sh.itjust.works -7 points 5 months ago (8 children)

Iirc chrome stores your local cookies/session in a place malware could also attack. Probably the same idea for other browsers.

I'm not sure I fully understand the issue here. If we're ok with that info being trivially retrievable by a bad actor, why isn't this ok?

Like I get you may not like it, and it's a target, but there are already lots of targets that have gotten a pass based on user permissions. Is it just the breadth of potential info? With the cookies you could potentially log into someone's bank account.

[–] ulkesh@lemmy.world 7 points 5 months ago (1 children)

First, false equivalency.

Second, we’re not okay with cookies and session being in a place that could leak — it’s why we’re doing everything possible to stop that from happening (I mean GDPR alone is one effect of this).

Third, the fact that you can’t see a difference between cookies, which actually can be secured via proper encryption and signing, and a literally unencrypted database driven by OCRed screenshots (taken every couple of minutes) that requires an opt-out and is a very small slippery slope to that data making its way back to Microsoft’s own servers for their own greedy pursuits….then I’m not sure what to tell you.

Recall is wrong. And it’s indefensible. Period.

If you think it’s okay, then feel free to open everything up to Microsoft of who you are and what you do on your Copilot+ PC. I, for one, among many, will choose to secure my information as best as possible, including never using another Microsoft product again, if at all possible. And I’ve already done so for myself.

[–] csm10495@sh.itjust.works -4 points 5 months ago* (last edited 5 months ago) (1 children)

GDPR has little to do with this. People use site cookies to remember sessions and not have to login again, etc. I'd guess most browser users use and want to use this functionality. If you're fully opting out to not even have persistent sessions, I'm guessing you're in the far minority of users here.

I'm not aware of any non-trivial readily available built-in encryption for cookies. There are easy to find libraries that exist to just pull out cookies (stored locally including session tokens).

To clear up a bit more misinformation from your response: this is an offline feature. The data doesn't go back to Microsoft. It works even if your computer is disconnected from the internet. If you consider their word to be a lie on this part, that's you're right to believe, but until proven, isn't a fact.

[–] ulkesh@lemmy.world 3 points 5 months ago

GDPR has little to do with this

Not at all true, GDPR is the exact reason why you see all of the sites these days letting users know that their site stores cookies and requesting acceptance of it. Hence why I said we, as a global society, are trying to do something about this, even if it's something as simple as cookie use disclosure on sites -- it's a start.

If you’re fully opting out to not even have persistent sessions, I’m guessing you’re in the far minority of users here.

Never once said I did.

I’m not aware of any non-trivial readily available built-in encryption for cookies.

You're correct, data-at-rest encryption doesn't exist for cookies, but data-in-flight does with SSL. Also, signing cookies and samesite origin is a thing being done these days, which makes them quite improbable, if implemented properly, to be hacked for any actual use in terms of leaking logins to said sites.

this is an offline feature. The data doesn’t go back to Microsoft

For the moment, that's what they say, yes. And that's the problem, especially since it's turned on, by default. This -- is not -- something -- Microsoft has earned trust for.

But you are free to believe them all you want -- the rest of us who have seen what Microsoft has done these past 40 years use that as a guide to judge -- and history is usually a very good judge.

load more comments (7 replies)

load more comments