Hacker News Reader

Comment by modeless | Hacker News Reader

It is puzzling to me that so many people seem to think this concept has no value. To me the concept is obviously good and something I have wanted for a long time.

Of course the security of the implementation is important and I agree with some of the criticism there. But I see a lot of people arguing that the feature is worthless, or that it doesn't make sense at the OS level, or that Microsoft specifically should not be allowed to add it to Windows, and I have to strongly disagree.

View on HN

Hmm. I think I can respond here.

No one is really saying this feature has no value. For a user, there is value to being able to get to a previous point in time. That feature, however, is clearly not very well designed and implemented if it took days for it to be cracked on the internet for everyone to see. If I could trust that it STAYS local, maybe I would be less paranoid. But this is MS we are talking about.

Personally, I am glad this thing was created. It may be finally make people hesitate over the evolution of PCs.

Indeed since this is MS you can guarantee this is just a another step in them expanding their ability to monitor your habits for further monetization.

> clearly not very well designed and implemented if it took days for it to be cracked on the internet for everyone to see

I really don't understand this line of thinking. What was cracked? That the database is readable, unencrypted? How could it be encrypted and usable at the same time?

> If I could trust that it STAYS local

This I agree with. While it's local now, not trusting MS is a valid belief, given their past behavior. If they feel sending some of the info to the cloud could get them $$$, then they will do it. Although I feel regulators might be pretty quick on this one...

<< I really don't understand this line of thinking. What was cracked? That the database is readable, unencrypted? How could it be encrypted and usable at the same time?

I am admittedly mildly confused by this response. Do online portals typically use unencrypted passwords? Do they let data flow unecrypted? Are those portals somehow unusable?

Could you elaborate a little bit? It is possible I am misunderstanding your point.

I have only been somewhat paying attention, but there were lots of stories about someone "cracking" the implementation of Recall and getting access to the locally-stored database. The criticism is that it is easily accessible, but it's hard for me to imagine it any other way and have it still be useful. It's still encrypted at rest, but must be unencrypted for data to be written to it.

There is plenty to criticize about Microsoft, but that one seems manufactured.

As far as I know, the database is local, and Recall does not use the cloud at all. That also means that you can't view the history from one computer on another. But I agree that trust that it will stay that way is not particularly wise.

<< "cracking" the implementation of Recal

I think you have a point there. Would you accept reverse engineering[1] as a more accurate term instead of cracking?

<< I have only been somewhat paying attention

We are in the same boat. I saw the thing pop in my feeds in the past weeks. I skimmed it, thought it was a bad idea, but since I don't have a PC that would be affected, mostly ignored it. I think I only pay more attention today, because it is the weekend and somehow my testing is not ready for me..

[1]https://en.wikipedia.org/wiki/Reverse_engineering [2]https://www.wired.com/story/microsoft-windows-recall-privile...

Ah I see. I guess that came across as criticizing your terminology, but it was more aimed at the general hype around those reverse-engineering articles, which seemed a bit over the top to me :)

Either way, I'm holding off on buying one of these PCs until some real-world info comes out (no one really has this capability yet, so it's all largely speculative).

I have also only been skimming the info but the issues seem to be:

1) Recall takes snapshots of user’s activity and then copilot analyses it and keep the info in a plain text database.

2) The database is accessible to other accounts in the same computer.

3) The database is kept very small in order to save storage space. The trouble is that it is so small that it takes no time at all to upload it. One researcher infected his machine with a know piece of malware. By the time the AV software recognized it the database had already been sent.

4) Oncenthe database is in hand it is trivial to see whatever the person was working on and what information was involved. Apparently you can literally see some things.

So yeah, collecting large amounts of sensitive data makes for a very juicy target.

> No one is really saying this feature has no value

Oh yeah?

> I have a really hard time understanding the use case for something like this. Stuff that I want to remember I just write down https://news.ycombinator.com/item?id=40612277

> the only people that really want this feature are the ones trying to push it down everyones collective throat. Why is MS pushing something so hard when nobody asked for it? https://news.ycombinator.com/item?id=40611263

> It really doesn't [sound like a cool feature]. Not a single person I've spoken to likes the idea of this, at all https://news.ycombinator.com/item?id=40445335

> i have never wanted to go back in history [...] what’s the use case https://news.ycombinator.com/item?id=40544521

etc.

The concept itself has value, but the ethical and legal concerns are severe, not to mention the issue of Recall also capturing sensitive stuff like passwords.

Microsoft, Google, Apple - everyone is scared shitless of some AI startup kicking their nutsacks, and is launching products that should have gone through extensive ethics discussions beforehand in a matter of weeks.

passwords are the last of it, think about women inquiring about abortions in states where they aren't legal. Or people trying to get away from an abusive partner, on and on it goes.

Agree on the "abusive partner" scenario, but regarding abortions, local police already can abuse dragnet orders on Google Maps [1] - even though they promised to auto-delete anything regarding abortion clinics, there are more than enough other ways for police to target pregnant people.

[1] https://www.npr.org/2022/07/11/1110391316/google-data-aborti...

> It is puzzling to me that so many people seem to think this concept has no value. To me the concept is obviously good and something I have wanted for a long time.

The issue is not that the concept has no value. The issue is that the risks and drawbacks are so severe, that they override any value the concept would have.

It's like asbestos, or leaded fuel; these have several useful properties, but their drawbacks are bad enough that they have been banned in many places.

That's your opinion, but you can't deny there are a lot of people arguing that the concept essentially has no value. Even on this very page.

> I have a really hard time understanding the use case for something like this. Stuff that I want to remember I just write down https://news.ycombinator.com/item?id=40612277

> It really doesn't [sound like a cool feature]. Not a single person I've spoken to likes the idea of this, at all https://news.ycombinator.com/item?id=40445335

> i have never wanted to go back in history [...] what’s the use case https://news.ycombinator.com/item?id=40544521

etc.

the concept is valuable but so ripe for abuse that even it existing at all is a threat to everyone's privacy.

I have been a windows user basically my whole life. 3 years ago I got an ipad pro (2018, 12.9") for drawing and I hate the operating system. 7 months ago I got a steam deck and its fine for games but doing anything in the OS is confusing and annoying.

Microsoft announced recall and suddenly I'm using a spare computer to test linux distros, and I suck at everything to do with linux and I'm doing it anyways.

It's too dangerous, to much an invasion of privacy, and too easily enabled completely outside of my control.

Reply on news.ycombinator.com