Security researcher discovers Microsoft's Recall tool is woefully insecure

That could be orthogonal for a company as large and diverse as Microsoft for both to be true at the same time. Like certain more enterprise facing products like the windows kernel or Azure could be very secure, while others like these user facing Windows features, very un-secure.

In general I noticed that most new tools and consumer facing features dropping on Windows 11 are of terrible quality, as if they were written by some web-dev interns rather than engineers experienced in Windows programming.

So this is funny in a way, because MS had such a terrible and mostly deserved security reputation with Windows...and then they really cleaned and tightened it up. Windows had and continues to have one of the best OS security architectures, and is certainly the best out of all consumer operating systems.

But with the cloud stuff and embarrassing gaffs like this, what the hell happened? New managers and a lot of employee turnover, I guess?

I, for one, very much agree with Belinda.

I really ask myself who cooked up that shit and who allowed it into the product.

It's super invasive. Nobody ever asked for it and just because they can is a rotten reason to impose this on your (presumably) customers.

> Let's call it what it really is, Gates power control issues because he wants to rule the entire world!

"my computer" > "this pc" meme is real

Based on the article, it is encrypted, but you can access it without manually decrypting it on every access.

TFA says it's encrypted at rest, with Bitlocker. When running, the data is accessible only to the SYSTEM user. That's exactly how I'd expect to implement this on Windows, I'm not sure what else you could do while offering the features it does.

The insecurity stems from the concept of Recall, not its implementation.

The main threat is from malware that compromises SYSTEM, or whatever user interface is offered onto Recall.

There's a second-order threat too - Microsoft changing their privacy policy in 1,2,3 years and feeding it to their AI models & 2317 advertising partners. Sure there'll be an opt-out - a paper form in a basement filing cabinet, with a sign saying "beware of the leopard" etc.

There's just no secure way of implementing a feature that collects and stores an enormous amount of new personal data.