Microsoft will switch off Recall by default after security backlash

Actions speak louder than words.

GenAI is hotter than anything else right now. As Satya publicly stated, "we made them dance" -- which shows how high-priority it is to maximize "AI innovation" at MS.

If you disagree, think about how badly "Tay" blew up in MS's face and yet they still went ahead and bundled OpenAI LLM tech into all of Office365, just so they could have bragging rights about beating Google to it.

At this point, it's a race (to where? who knows) and no Big Tech Corp wants to be seen as "not at the forefront".

That's my $0.02, anyway :)

> And then someone goes and invents Recall

Maybe you should read about the history of Microsoft, especially about its security.

But people forget easily.

On the other hand, I am always freaked out by Chrome extensions that "can read and change your data on all websites". Can't they have more granular permissions? You gotta have a lot of trust for those extensions LMAO. They can read your bank passwords, probably!! And if they are ever sold...

I think it's the right move to have it off by default, but I'm just not convinced by the outrage here.

No one retweets "Attacker gaining root access reveals all user information", but instead "Attacker gaining root access reveals all user information collected by AI program" will go viral for sure.

Most of us know that the public Internet is based on surveillance capitalism, no matter if we hate it or are just complacent or ignorant.

OS wide is far more problematic and of low value to the user.

I get your point, but Microsoft's Recall can capture anything onscreen - emails, personal info, porn, passwords and the like. And it feels, bizarrely for 2024, that little thought has gone into privacy or security.

Or from history you may see that you accessed a site, but not what you did on it (what comments you typed for example).

At the time, it wasn't very thinkable that someone would have the audacity to take and abuse that information.

It dates from when Internet people overall were more savvy about privacy than users overall today are, but it was also when the Internet was closer to a trustworthy environment, and before Wall Street sociopath types took over the tech and the culture.

Lots of kinds of abuse that today are routine and almost universal, for even startup tech companies, (e.g., embedding third-party trackers into Web site, and getting even worse from there), I think would've gotten them ostracized, and outraged demands for criminal charges.

During the dotcom gold rush, there was such a flood of totally new, posturing people, and so much money being thrown wildly at everything, that any remaining outrage was lost in the noise.

And now virtually no one knows any different.

But if you're trying to push some new abuse today, I think ordinary people are starting to have some awareness of what vicious sociopathic buttholes tech companies have become, and so acceptance might not be a slam-dunk.

2. Browsing history watches one app. Screenshots watch everything across the entire OS.

Does your browser history store pictures of your family?

Whereas to avoid browsing history, one only has to avoid the popular, graphical, advertising corporation browser. As I am not interesting in graphics, I do this everyday, with ease, because there are countless clients besides "Chrome/Safari/Edge" that work with the www for consuming information.

There's also always private browsing, which exists specifically because people are aware of the implications of a browsing history and a persistent cookie jar.

That awareness will be much harder to build for an always-on screen recorder.

Recall seems to be storing its info locally in an unencrypted SQLite database as well.

At least, that's according to the instructions here on how to access and view the contents:

https://www.heise.de/en/news/First-experiences-with-Recall-9...

From the submitted article, it seems like Microsoft will change/secure the access (and maybe storage) in some way, though there's no details on the specifics.

I want to be able to find things I've seen before. Recall would've been great if using it didn't require me to update to a version of Windows that contains "Copilot".

If that occurs, the malware won't have access to months or years of data to sift through.

This is what will happen. And when you turn it off again, it'll be turned back on by the next update. Enjoy.

Once you have the Recall capabilities, it doesn't take much to start collecting and searching the data.

[1]: https://www.patrick-breyer.de/en/posts/chat-control/

Compliance doesn't say "company can't watch employee" -- in many cases it mandates surveillance.

This just lets the employee leverage that too.

They’ll probably think twice before jumping into the fray again with the Microsoft branded Informant Wire (I mean AI wearable) ;)

At one place I worked when the company replaced my old machine with a new windows 10 system it was configured to send every single keystroke back to Microsoft. There was zero concern over privacy or compliance, just an assumption that MS would never abuse that data for any reason. I did not have their faith and disabled that "feature" then changed a massive number of other policies to try and keep as much data out of Microsoft's hands as I could.

A reply about tangible products that people can choose to purchase or choose not to purchase is not a response to the comment I am making. These are examples of conscious choices, coupled with payment.

With few exceptions, non-enterprise Windows users are not consciously choosing to purchase a Windows license. They are choosing to purchase a computer. The decision to purchase a Windows license was made by the OEM. If we ask these computer purchasers what they bought, they are likely to describe a tangible product, e.g., "I bought a computer", not a license to use an operating system.

If something is wrong with the computer, then the purchaser can generally contact the seller/manufacturer for redress. But when the problem is with Windows, consumers generally do not contact Microsoft. Instead they complain into the ether.

Good luck enforcing warranties or products liability laws against Microsoft with respect to a free copy of non-enterprise Windows that was pre-installed on a computer. Windows can be broken six ways to Sunday, it can be a defective "product", and Microsoft can take its time fixing the problems, or even just leave them as is.

If chat and co-pilots are all we get out of this wave of investment, then I'm not sure if it's been worth it.

https://www.rewind.ai/

Personally, data privacy/protection and compliance aside, I’d find it fairly useful on my work computer.

But just because something has utility doesn't mean it comes at high costs. I mean it's a super powerful keylogger that is searchable without technical knowledge. Not to mention that it'll probably fail to LLM type of attacks, which even many non technical people are able to figure out.

But then again, I don't understand why people so passionately store all their chat logs (not just important/memorable messages) and take millions of photos. We kinda spy on ourselves

Giving your screen recordings to Microsoft is like giving a loaded gun to a toddler.

Now that I'm a developer, I often get into the flow and find myself knee deep in some work, but I forget to write notes about what I was doing. Coming back the next day, I often can't remember what issue I ran in to or how I fixed it. Having a quick way to review what I did the previous day is very helpful.

I can see a lot of potential uses for this technology, but I'm quite wary of any service that involves sending all of that data to some third party. Regardless of how much they might swear they won't use it for anything else, every company eventually sells your data for extra profit - it's just too tempting.

Internet access is not always guaranteed or reliable. Please do not assume that the cloud is a viable solution for every user.

I ran into this on my phone awhile back. I knew I would be out of service for some time but had some PDFs I needed to reference. So I downloaded them to "files". Que surprise when I later go to look up a value and there's a little cloud with a down arrow button next to the PDF in the files app, which of course fails because I'm nowhere near any internet access. Even more fun: turning off the cloud integration in files just causes the files to disappear, even if you are currently connected. It's allergic to local storage.

Not trying to make this sound like a value judgment, more an observation. But it makes you wonder, what do we lose by excessive abstraction.

If you're hard coding paths you're doing it wrong.

The fact that I needed to log in, wait 24 hours for my account to unlock due to inactivity (!!!), and enable sync in order to disable it was enough for me to finally decide that Windows 10 will be my last Microsoft product. It may be a small annoyance, but to me it was the straw that broke the camel's back.

I have disposed of my last PC now and have nothing to do with the infernal things, or onedrive, or any of that crap ever again!

I like this video of Jonathan Blow ranting about the file explorer: https://www.youtube.com/watch?v=le6dvr95Z2Q

I did later connect my Microsoft account. In my installation the OneDrive folder is empty and the entries in Explorer map to the normal places (C:\Users\X\Pictures etc). If I open one of the default folders, it does show a "Start backup" entry in the address bar that is referring to OneDrive, though. If I open the OneDrive folder, it asks me to sign in (entering password) and set it up-- which is funny, because the Windows user is signed in using a Microsoft account already- so seems like they haven't connected those dots properly yet. In theory this might be their way of implementing a security check for uploading all your files, but if so it's an awkward way to do it.

> Additionally, some programs still seem to want to use the OneDrive folder by default, like I think Office programs still do their best to use them.

If I remember correctly, there is an API that programs can use to locate common folder locations for users (such as Documents, Pictures, etc). My guess is that your account still points to the C:\Users\X\OneDrive\Pictures instead of C:\Users\X\Pictures. If you could adjust those directly (maybe in the registry?), I would imagine that it will work correctly in these programs, especially since I doubt those programs would break on my setup, where there is no OneDrive subfolders (though I don't use Office so I can't check). And in case you wonder if there really are no subfolders in OneDrive since I can't open it in Explorer without signing into it- it shows nothing when viewed via PowerShell.

The former because my desktop is... where I want things just a certain way for THIS computer, not across the cloud. And because it's a PITA to undo and set it the correct way.

The latter because of course I use Remote Desktop on multiple computers, but it keeps saving a "default" file in the same place across computers, and throwing errors left and right because they conflict. So stupid.

And for that matter, make Apple do the same for iCloud; I'd love to keep all my iPhone stuff in my own self hosted "cloud" and get 1st party integration.

For Windows 11: https://www.tomshardware.com/how-to/install-windows-11-witho...

Apple also uses dark patterns to try and get a monthly income from customers. Apple has upsells and nag nag nag advertisements for iCloud.

The irony with Microsoft is that I would consider paying a monthly fee for a modern version of Windows 2000 without extra features. No adverts, no telemetry, no OneDrive, no cloud signin, no store, no games installed as part of the OS, no MS junkware, no bullshit. Aside: why is there no "Windows for developers" - even Balmer knew "developers developers developers" was worthwhile but Microsoft has deleted that from its DNA: even though Apple's competition is a mixed bag.

Meanwhile Recall takes a stream of high-quality images, from which a full reconstruction of your entire computer-use activity over the last 90 days can be reconstructed in high fidelity and searched through.

From a security point of view, the threat models are a world apart.

I think most, if not all, of the overwhelmingly negative feedback is tied to this being enabled by default, and shipped by default

I assume they would push it for the same reason they would push any other mildly-useful feature improvement.

I'm not sure who at the org is pushing for this as it would essentially hand the PC games market to SteamOS. I suppose they saw how well it's worked for enterprise customers that essentially already use a Windows VM through Citrix or some other provider, and think this would solve the virus/malware problem once and for all.

To be frank, I would not mind having this feature on linux provided it was entirely local, and encrypted.

Here's the thing. When no-one asks for it, hard push is the only way to sell it.

:)

Microsoft was last to the party.

It's easy to say if you aren't one to benefit from this, but that doesn't mean no one will or that no one asked for it.

Most recently I used it to refresh my memory on a particularly convoluted way to authenticate with a third-party oauth system (it involved using an online oauth debugger and curl commands). I had gone through the process once successfully weeks ago, but by the time I had to do it again I'd forgotten every detail. Rather than have to go through the process of figuring it out again, I went back to my successful attempt, watched it, and basically retraced my steps. Rewind probably saved me an hour or two.

My take on Recall is that, like with almost everything, it's a trade-off of security for convenience. I find it valuable enough that I'm willing to make the trade-off, but others might not.

There were definitely some comments in a previous HN post about it that attempted defend it and to paint everyone else as overreacting. Several of them even said that they thought it would be useful for something they might hypothetically like to remember or search for... I don't really remember, because the whole thing is crazy to me and I think it's crazy for any tech-savvy person to be running Windows in 2024.

> Why is MS pushing something so hard when nobody asked for it?

I assume this is a rhetorical question, but just in case it isn't: this is not a feature/product for Windows USERS. This is a feature to help train/test MS's AI stuff- YOU are the product, not the customer.

The natural next step is to have a local model trained on everything I’ve ever done, and for all of my computing tasks to be contextual to that history.

I could see this transforming how we use computers.

But I wouldn’t go anywhere near Recall.

I suspect Microsoft is pushing this so hard because they want to do what I just described, and they want to start collecting the data necessary to enable it ASAP.

I can easily see a future capability that people might love that they wouldn’t have even known to ask for. But the way they’re rolling out Recall is certainly not a good foundation.

But for non-technical people, of course, computers are already unpredictable. They routinely (appear to) misplace files and overwrite them with previous versions, and if the URL falls out of autocomplete the site might as well not exist. For people who google to find the Facebook login page, this would simply be how computers should work. You tell it to give you the thing and it gives you the thing. How that happens is immaterial.

Most of those features are garbage and make the product worse, either because they don't address an actual problem or because they are implemented poorly. But of course improving the product is at best a secondary concern, chasing the hype is far more important, both for the company itself and the individuals building this stuff.

Because they bet big on AI, and hardware suppliers bet big on AI-enabled hardware, and so they are trying to find use cases for it.

I disagree. I would feel quite comfortable using functionality like Recall on my personal computer, on which I of course run Linux, if it was opt-in. It's a great idea.

The problem is that it's an idea that's just not compatible with how Microsoft is running the Windows platform, the relationship the company has with its customers, and that it was originally announced as impossible to disable.

Recall as default-on for managed corporate devices is preposterous, for example.

They claim they're all in on making Linux work seamlessly on the Snapdragon X. I'll leave it up to you on whether or not to believe them.

I have, and I am still happy to be on Linux as my daily driver for over 20 years now.

At this point MS is a toxic company that you’re better off, as a user, to steer away from.

Not if you're using Microsoft products, no.

People continue to get irritated when "we" do this, but here I go: you should be running Linux exclusively on your personal computers. You should also stop buying "smart" shit.

No, we can't. Peaceful, content, satisfied, private, conscious makes less rent than disturbed, displeased, unsatisfied, surveilled. So while some people desire the first set, some others desire the second, and so, the cat-and-mouse game continues.

Mind bogglingly tone-deaf and out of touch with what users want

That's all.

If they're that essential for our existence, then go ahead and sell it to consumers.

As the Rabbit (and Humane) before it demonstrated, none of these things are (a) essential, or (b) polished and ready for daily use.

After their success with installing Teams, Microsoft has seen that the regulators will not proactively stop this kind of thing anymore

Similarly with airtags, you have been able to buy cheaper cellular based GPS trackers for years prior to airtags existing.

In the airtag case, those GPS tags also do not alert the individual that there is a beacon following their person, and as such most likely go unnoticed and under reported.

Instead you should hurt their business. Ditch Windows, switch to open source solutions, do not but their product and services. This is the only language they understand.

It's not really about looking back at your own activity in case you forgot. But the AI will use it to learn about your habits, wants and hates, interests, people you deal with, usual schedule etc.

An assistant is after all much more effective if it knows you through and through. The one problem is: I don't want Microsoft to be that assistant and know all that about me. Even if "it's all local". They still control what gets done with that info and can change it at any time.

(I’m being a bit provocative and assume today it stores locally only but a future TOS change will secretly and “anonymously” upload your data ‘for training purposes’ —- that’s what everyone else is doing these days)

> on by default in Windows 11 25H1, impossible to disable in Windows 11 25H2

If Recall continues to inspire grumbling and receives very little praise, I could see it unceremoniously removed in a Windows 12 26H2 Feature Update.

Have you given Linux a try? Unless you have an Nvidia card or an Adobe workflow; it is usually good. The Nvidia issue may go away in a year.

If you still hate Windows least, that's almost certainly because it's what you know best. I work with Windows, Linux, and OSX on a daily basis and Windows is easily the most user-hostile of the three.

Edit: All you know -> What you know best

Would you like to share what you like about windows that you don't have on other operating systems, or what puts you off about other OSes? Not trying to be passive aggressive, just curious

Windows is soo low quality. It feels cheap. It feels like you are at a car dealership.

Fedora, feels like you are at some futuristic office that has buttons that do multiple steps. I was literally angry last year that it took me so long to learn about up-to-date linux. Canonical's marketing of debian-family linux gave Desktop Linux a bad name.

I'm considering Linux with a Windows VM for Visual Studio. I've had my Linux detours in the past and it honestly works pretty well for me. I personally enjoy Fedora with Gnome which I think strikes a good balance between stability, security, and freshness. But if being stable and worryfree is of top importance (like where you are "unpaid tech support", haha), why not just go Debian. :)

He ended up switching to Apple around 15 years ago after a series of bad experiences. He was very nervous about it, and really hedged his bets early on. It took him some time to get used to how the OS worked, to find new apps to replace some that he had used since the Windows 3.1 days, and sort out his workflows. He eventually gave up his Windows VM when he realized the only thing he ever used it for was to run Windows Update.

I grew up on Windows, with the views from my dad instilled in me. In college I tried Linux and ultimately moved to the Mac about 21 years ago. I still used Linux on and off for the past 22 years (and currently have a music server running it). I do find Linux to still be much more finicky than macOS. No system is perfect, but macOS is more of a "just works" operating system than Linux (imo), likely due to the focus on polishing that last 10% of the user experience, that never seems to get the attention it needs in Linux. While I am excited to see what Cosmic has to offer later this year on Pop OS, I'm always ending up having to deal with some level of nonsense, even my most recent install of Mint just last week had a few annoying things where things didn't work, and they should have worked.

"microsoft office features y and j require Recall! please click here to enable it"

etc etc

Microsoft, Google, Apple - everyone is scared shitless of some AI startup kicking their nutsacks, and is launching products that should have gone through extensive ethics discussions beforehand in a matter of weeks.

I have been a windows user basically my whole life. 3 years ago I got an ipad pro (2018, 12.9") for drawing and I hate the operating system. 7 months ago I got a steam deck and its fine for games but doing anything in the OS is confusing and annoying.

Microsoft announced recall and suddenly I'm using a spare computer to test linux distros, and I suck at everything to do with linux and I'm doing it anyways.

It's too dangerous, to much an invasion of privacy, and too easily enabled completely outside of my control.

No one is really saying this feature has no value. For a user, there is value to being able to get to a previous point in time. That feature, however, is clearly not very well designed and implemented if it took days for it to be cracked on the internet for everyone to see. If I could trust that it STAYS local, maybe I would be less paranoid. But this is MS we are talking about.

Personally, I am glad this thing was created. It may be finally make people hesitate over the evolution of PCs.

The issue is not that the concept has no value. The issue is that the risks and drawbacks are so severe, that they override any value the concept would have.

It's like asbestos, or leaded fuel; these have several useful properties, but their drawbacks are bad enough that they have been banned in many places.