Hacker News Reader

Comment by azinman2 | Hacker News Reader

I don’t understand how the gap was so large between them saying this data was encrypted/protected and people easily being able to get the raw data. I know once you’re on someone’s machine in a way all bets are off, but it feels like this should have had far greater security attached to it. It doesn’t seem to even match their promises. Couldn’t this have been seen a mile away?

View on HN

The fact that Recall data and screenshots are only protected at the file system level reinforces the reality that Windows lacks user-centered privacy and security. Microsoft is content to rest their laurels instead on system level control.

I know microsoft has crap security, but in this case they probably aren't lying about it being encrypted. Encryption for storage simply isn't a solution that most people need for security of data on their devices. It pretty much only protects against the threat of a device being stolen, and that simply isn't the way most people lose their data. Almost every virus runs as the main user of the PC, so almost every virus will be able to decrypt the recall storage.

Microsoft should know this so it is easy to say they were disingenuous even raising this as a point. If Windows is to be secure it needs to fundamentally change its security model and that means breaking compatibility with a huge number of applications. So that probably can't happen.

macOS and iOS have later rolled out methods of data containerization on top of existing file systems. Microsoft certainly has the talent to do this as well. They shouldn’t have shipped a product without the necessary requirements in place - it’s quite obvious the sensitivity of this data.

Reply on news.ycombinator.com