Comment by Renaud | Hacker News Reader

Comment by Renaud | Hacker News Reader

Parent Full thread

Isn't MS Rewind/Recall supposed to be encrypted and offline, on-device only? I don't see how it could be anything else and pass any data-protection regulation (in the EU, at least).

It's a hazard and its usefulness needs to be balanced with other needs, but on a work machine that belongs to me, it could be useful. Now, if my boss has unfettered access to this data, or any of it is online, then obviously it's a no no.

Understanding the implications of tools like this is necessary. I'm not too optimistic that the general user will fully understand these implications though. That's one of the main danger with these technologies: promises are made, people don't think twice and overshare, and the data is used against their interests.

However, I want it to exist, MS or Open Source, preferrably, but only if I get 100% control over it, and it is never accessible to anyone else.

Having said that, I'm very much aware that most implementation of these tools will become a security and surveillance nightmare.

The next few years are going to be interesting, and probably frightening.

>> Isn't MS Rewind/Recall supposed to be encrypted and offline, on-device only?

From what I have been reading, the raw data is meant to remain local (the screen recordings) but I am unclear about the indexed AI-generated metadata. For instance, if the AI identified that you used X software at Y time to complete Z task, are the XYZ tags kept local or archived elsewhere? That might not violate many privacy rules. Either way, they certainly could be uploaded/shared very easily should Microsoft's policies change. I guess it is down to how much we all trust Microsoft long term.

Personally, I will never accept someone recording my screens. In fact, running any such software on my work machine would violate a host of professional rules.

I can’t imagine them not providing a way to turn Recall off, for reasons like the ones you describe.

Oh I'm very sure there will be a box to untick, which we will all have to dutifully check after every tiny software update.

That's what I assume, they're very specific in saying your screenshots and recordings are kept locally to be analyzed by the AI, but they don't mention the data generated by the AI from your activities.

If the data can be accessed by the user, it can be accessed programmatically -- no? It's available locally for something malicious to exfiltrate.

So Rewind expands the "locally malicious software" scenario from "it accesses all my files and it can monitor me going forward" to "it accesses all my files and it can monitor me retroactively for a few months and also going forward"?

That's a little bit worse but not much worse.

It's much worse, because even if you detect the malwar after a few hours it's still enough for it to steal all your past recording.

But to be honest nobody in the malware world cares about your screen unless you're a president or CEO. They will just steal your passwords, and either encrypt your disk or use you as a residential proxy.

It seems a lot worse, even if malware runs for a short time it could have access to so much stuff.

>I don't see how it could be anything else and pass any data-protection regulation

>Having said that, I'm very much aware that most implementation of these tools will become a security and surveillance nightmare.

The contradiction of the quoted statements nullifies anyone's ability to make sense of the theme in the post.

No real contradiction: MS implementation is probably in line with current data protection regulations. Everyone has eyes on them.

Doesn't mean others will take as much care, or that new cool tools will not push the boundaries of what's ethical, safe or even legal.

We've seen it with many industries, not least the ad industry: some actors stay within the dotted line, but there is tremendous financial incentive not to.

Reply on news.ycombinator.com