this post was submitted on 22 Oct 2024
120 points (95.5% liked)

Privacy

31679 readers
784 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

Chat rooms

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago
MODERATORS
 

If one chats/mails with a person using Windows, despite using secure private protocols, every message will be stored by Microsoft's Windoze Recall. Either I'm missing something but this feature seems like the most grotesque breach in online privacy/security.

What are ways to avoid this except for using obfuscated text?

top 50 comments
sorted by: hot top controversial new old
[–] Anticorp@lemmy.world 23 points 23 hours ago (2 children)

This is a perfect example of why all of these privacy intrusion practices should be illegal. The same goes for services like Gmail. I use my own email server because I don't want Google reading my messages. But it doesn't matter, because everyone else uses Gmail, so any time I communicate with someone, Google reads my emails, despite the fact that I never agreed to their oppressive ToS. It's a blatant violation of our right to privacy.

[–] FriendBesto@lemmy.ml 3 points 2 hours ago* (last edited 2 hours ago) (1 children)

It is the same with Google Fonts. Everyone uses them, so your browser will have to ping Google Servers to get them. Even blocking them, puts you in a smaller bin of users since most people do not block them, which can help them profile you.

I got lucky and forced everyone I keep mostly on touch away from Gmail and into either my Nextcloud instance chat and/or Signal, XMPP or Delta Chat. Which are on mobile.

Another user mentioned PGP, great in theory, but most people I know do not use it and will not touch it. They think it is too complicated, which is not. But people are lazy if they do not care about privacy. I got lucky that I made most switch.

[–] Anticorp@lemmy.world 1 points 54 minutes ago

That's a great point about the fonts. And Google Analytics, and AdSense, and their jQuery CDN. They have a whole lot of ways to inject their tracking into every site out there.

[–] arscynic@slrpnk.net 6 points 22 hours ago* (last edited 22 hours ago) (1 children)

But it doesn’t matter, because everyone else uses Gmail, so any time I communicate with someone, Google reads my emails, despite the fact that I never agreed to their oppressive ToS.

That's avoidable by PGP encrypting your emails though. But I'm sure you know that, and I'm sure you meant that getting most people to use PGP is a pipe dream.

[–] curry@programming.dev 6 points 22 hours ago (1 children)

Even if you got them using PGP somehow, there's always a risk. Apps designed to upload screenshots, share contacts or simple human errors like "hey did you hear X saying Y", etc.

[–] arscynic@slrpnk.net 4 points 20 hours ago

Yes, but Recall is spyware by design posing as a benign feature. This kind of unethical behaviour I vehemently oppose.

[–] Kryptonidas@lemmy.wtf 67 points 1 day ago (1 children)

If you tell something to someone else, assume it’s compromised.

[–] toynbee@lemmy.world 13 points 1 day ago

"Three can keep a secret if two of them are dead."

(Even then I'm not so sure)

[–] glimse@lemmy.world 42 points 1 day ago (2 children)

Turn off your computer, move to a cave in the mountains, and abandon society.

A bit extreme but there is nothing you can do to stop your messages from appearing on Windows machines except not sending them to anyone who might view them on Windows machines...which will definitely be nearly impossible in 2024

[–] CHKMRK@programming.dev 10 points 1 day ago

Works great until some hikers take a photo with you in the background, that gets backed up to iCloud, then they want to show the photo to a friend, download it to their computer, open it and BOOM, Microsoft AI knows your face

[–] arscynic@slrpnk.net 5 points 1 day ago* (last edited 23 hours ago)

I couldn't wait to post this obligatory fragment of Parks and Recreation - Ron vs. Online Privacy: https://youtu.be/8xn1rO1oQmk

[–] pHr34kY@lemmy.world 100 points 1 day ago (1 children)

If it leaves your device, you cannot control it.

[–] doctortran@lemm.ee 5 points 20 hours ago* (last edited 19 hours ago)

Right but you could at least be reasonably sure it wouldn't be outright spied on from the person you're sending it to. Now it's almost a guarantee.

Like if I sent something to a friend of mine, I could be fairly certain it wouldn't end up in the wrong hands unless they got compromised or did something stupid. I could trust their competence.

Now everyone that isn't actively managing their own windows installation is absolutely compromised, as a rule. Like I can't just send an email to my mom anymore, from now on its always my Mom and Copilot.

[–] Alexstarfire@lemmy.world 107 points 1 day ago (1 children)

Can't control what other people do so you might be out of luck.

[–] arscynic@slrpnk.net 5 points 1 day ago (2 children)

It's more about what Microsoft enforces—spyware—than what other people do.

[–] doctortran@lemm.ee 2 points 20 hours ago

Yes, and that's a valid concern, but there's no good answer here. That's why it's such a problem. From now on, one of the most widely used operating systems in the world is going to be harvesting data from any and everything that appears on it. Meaning any software you use to send any form of electronic communication, if a Windows computer opens it, and the user either hasn't bothered or doesn't know how to disable recall, your information has been harvested by Microsoft.

There's just no way to limit or avoid this. We need regulation.

[–] Alexstarfire@lemmy.world 3 points 1 day ago

I meant you can't stop then from using Recall.

[–] communism@lemmy.ml 11 points 1 day ago

If there's anything sensitive I'm communicating with someone digitally, I make sure that the person in question has basic tech security skills and knowledge about privacy, including telling them to stop using Windows. Including taking the time to teach them basic stuff (like full disk encryption, VPN and Tor usage, explaining E2EE, etc) myself. If you have a high threat model but are talking to non-techy people, you should be taking the time out of your day to do this.

If you're thinking "wow I can't be bothered to do all that", your messaging is probably not sensitive enough for this to be a significant concern. Not that "if you have nothing to hide you have nothing to fear", but just "the amount of time you put into security and privacy should be proportionate to your threat model and the cost of compromise".

[–] drwho@beehaw.org 6 points 22 hours ago

The best way is to use comms channels that avoid their Windows install entirely. If Recall never sees it, it never gets recorded.

[–] unrushed233@lemmings.world 8 points 1 day ago (2 children)

Either use secure, encrypted VoIP calls (e.g. over Signal or another secure messenger with an end-to-end encrypted call feature)

Or you use a secure messenger that only runs on smartphones and doesn't have a desktop client

[–] notTheCat@lemmy.ml 5 points 23 hours ago (1 children)

This is just horrible, fuck big tech and their services

[–] unrushed233@lemmings.world 4 points 18 hours ago
[–] MalReynolds@slrpnk.net 21 points 1 day ago* (last edited 1 day ago)

Wow, valid issue.

Spitballing, potentially a secure app could run memory only, blah, blah, blah. Nope, you've given M$ your screen FFS, it's all over. If you care, move elsewhere, tell your friends...

As you point out, codes are an option, but it's not a slippery slope, it's a waterslide.

[–] MentalEdge@sopuli.xyz 26 points 1 day ago* (last edited 1 day ago) (2 children)

Don't forget that while they managed the PR better, apple "Intelligence" also has access to damn near everything on your devices.

[–] desentizised@lemm.ee 6 points 1 day ago (1 children)

Yet there's no backlash because they're not so stupid as to say "we're gonna take screenshots as you go so we can improve your digital life kthxbye".

[–] MentalEdge@sopuli.xyz 3 points 1 day ago (1 children)

"Private cloud" as if that isn't an oxymoron.

[–] sic_semper_tyrannis@lemmy.today 1 points 10 hours ago

And the fact that Apple Intelligence is just OpenAI

load more comments (1 replies)
[–] BlastboomStrice@mander.xyz 26 points 1 day ago (1 children)

Ugh, I didnt think about that😬

[–] jaxiiruff@lemmy.zip 17 points 1 day ago (1 children)

Me neither! Microsoft needs to be taken to court over this because it is a serious breach of privacy to not only record the users but even random bystanders as well. Now I am convinced this is just a backdoor for the government hiding in plain sight. Fuck them.

Oh this 100% is the government backdoor that they've been begging for. "If you can innovate your way into it, you can innovate a way out of it."

That was in regards to Apple phones belonging to Boston bombers being encrypted and locked.

It's no surprise that behind closed doors, the government asked these companies to create backdoors for them to spy on people.

[–] autonomoususer@lemmy.world 9 points 1 day ago* (last edited 1 day ago) (1 children)

You must start spreading libre software effectively. You don't control their device. You must show them how to fix it.

[–] arscynic@slrpnk.net 1 points 3 hours ago* (last edited 2 hours ago) (1 children)

Last year I did so by writing the essay “What if I paid for all my free software?” It came across well. Now I'm thinking of ways to reach a broader audience in order to not only be preaching to the choir.

[–] autonomoususer@lemmy.world 1 points 2 hours ago* (last edited 2 hours ago)

I would focus on those directly around you first (not online strangers) and showing them by example to do the same, like my last post. Rather than telling them, find ways to make them want to ask you themselves. Make them start the conversation.

[–] GetOffMyLan@programming.dev 9 points 1 day ago (1 children)

It can be turned off so it's up to the person you're messaging. Once you send something the person at the other end is in control of what happens to it.

[–] arscynic@slrpnk.net 12 points 1 day ago (3 children)

Once you send something the person at the other end is in control of what happens to it.

True, but this is the beauty of trust. I decide to communicate one way or another with someone depending on the level of trust. Them deciding to break that trust is a risk I chose to take. However, I do not choose to communicate with Microsoft, whatsoever. Windows Recall is the most blatant piece of spyware ever; beyond comprehension how this is so normalized.

[–] desentizised@lemm.ee 4 points 1 day ago* (last edited 1 day ago)

Society just needs to get over this AI fad atm. By which I'm not trying to say that AI won't revolutionize pretty much everything in our lives eventually, but first we need to figure out what it can actually be useful for. Or rather non-tech people need to be fully introduced to both its benefits and its pitfalls before tech companies will have a clear picture of where the red lines are for people ideologically speaking. We the nerds have our moral compass figured out but we're a minority when it comes to who these products are made for.

Leave it to Microsoft to come up with the most dystopian AI concept yet. But to be honest I'd be way more wary of a company like Alphabet for whom data collection is much more central to their business model and who know how to package their spyware neatly. Microsoft announcing this as a feature from a podium shows how tonedeaf they are but I'd argue it also shows that they're not following some self-serving plan behind the scenes to take advantage of that thing they're so proud of publically (a mass espionage at which I firmly believe they wouldn't be anywhere near efficient enough if they tried). They really must've thought that this is what can get Windows back into the limelight. It is Microsoft's problem of our time that with everyone being on smartphones and tablets now they are losing traction in the consumer market by the day.

Point being (as far as the valid privacy concerns go) that Microsoft were never in the data business. They're just really really bad at understanding what consumers want out of an operating system. I got my first own PC in 2001 right when XP came out. They've always been bad at making things work for the user. And since Vista all they've really been doing is copying Apple's eyecandy. First off of macOS (then OS X), now with Windows 11 they basically want to look like a tablet OS with app icons once again after that idea failed spectacularly under Windows 8. I'm basically just rambling at this point but it should go to illustrate their lacklustre corporate decisionmaking. I wouldn't be worried about their potential desire much less their ability to compromise that Recall data. Yes it's a hugely concerning concept from a privacy standpoint and every step to circumvent its analysis should and arguably must be taken, but I also wouldn't lose sleep over the data it is collecting on other people's machines.

Then you have to trust the person you are communicating with has turned off windows recall. That has to be the starting position.

Tools will come to block or break windows recall but it will still be based on trust that the recipient is using them. Privacy centred apps like Signal wouldn't want windows screen shotitng every message for example. There are many apps and tools including in the professional sphere that would not want their data leaking via recall so it will come.

Unfortunately it may come late in the professional realm probably after scandals break. Employers using recall data to investigate staff for example - it's bound to happen eventually.

My own organisation, a huge health organisation, has opted in to CoPilot. It's crazy in my view, even if our data is ring fenced in some way. I don't want private patient information being used to train Microsoft shitty tools, or stored on their servers. Regulation and the law is way behind when it comes to this stuff.

load more comments (1 replies)
[–] reddig33@lemmy.world 17 points 1 day ago (1 children)

So is there a way for businesses to disable this garbage feature through managed device settings or something? I’m guessing corporate legal departments aren’t going to be too thrilled with this feature.

[–] egonallanon@lemm.ee 6 points 1 day ago (1 children)

There's a CSP for disabling it on windows enterprise devices at least. Not sure if there's a way for pro and home machines.

load more comments (1 replies)
load more comments
view more: next ›