Hacker News Reader

Comment by Analemma_ | Hacker News Reader

Yeah, I think this entire debate is uninformed hysteria and manufactured outrage. "If an attacker has administrator access, they can see everything you have done on your computer!". OK? That has literally always been the case? "Attacker is root" is game over and always has been. The original writeup from DoublePulsar tried to justify that Recall is somehow different from other such scenarios, but I found it totally unconvincing.

I think it's the right move to have it off by default, but I'm just not convinced by the outrage here.

View on HN

Browser history doesn't show my passwords, everything I typed out and did on the machine.

In comparison browser history is nothing.

You’re missing the point. An attacker can only see the passwords in your Recall database if they have root, but if they have root there are (and always have been) a thousand other ways they can get your passwords. There is no new attack vector being introduced by Recall.

If an attacker got root with recall they might not need to wait the user to type their password and risk detection. The information they want to know might be already in the recall database.

One difference is that you can get root access after the fact and get however much prior data Recall recorded vs only going forward.

It is possible to access to Recall database without admin access.

https://x.com/GossiTheDog/status/1798832390070276500

RTA, Microsoft announced changes to the security model to prevent that.

I did read the article. The person I'm replying to claims the entire debate was "uninformed hysteria", which means they thought the previous security model already required admin.

Another big, big difference, anybody, not just some black-hat pro with a long kill chain of zero-days, has a fantastic source of data to exfiltrate.

Perhaps you didn't note before, or are one yourself, but this includes e.g. abusive spouses. Sure, maybe the abusive spouse could hire a black hat, but this is very different to a drunk low-life wife-beater casually snooping through "recall".

It might not be a "new" attack vector, but its absolutely a complete degradation to any computer security.

You can get cookies/tokens from chrome databases so its the equivalent to passwords in alot of cases

Except that before today you didn’t even need admin for access to the database, any process that is allowed to read things could access the Recall database.

Recall FEELS like being watched. Your browser history does not.

To be clear, I am not in favor of Recall or dismissing its intrusiveness. However, the correct comparison is not just "browser history". Google is also tracking your search history, passwords (built-in password manager), location history (Google Maps), ad clicks, and more. All-in, it's a LOT of data.

I'm with you -- I avoid Google products for the reasons you listed and am staunchly anti-surveillance capitalism. I just meant to say that even for a person with my very plugged-in perspective on these topics, Google's violations of my privacy still don't feel quite as invasive as Recall feels, even if on paper it's just as egregious and dangerous.

In a typical bigcorp environment, laptops are loaded with silently installed spyware. Certainly equivalent to taking a screenshot every second or an always-on keylogger.

The horse is out of the barn for many people during work hours. But in the OS and on by default is a different story!

Someone with root access can't see anything that has been deleted, or the contents of secure web pages I've visited, like my banks, doctor, or email. Very different.

Reply on news.ycombinator.com