Specifically regarding credit card security, it’s not really my problem is it? It’s the bank’s problem.
The law makes it so.
The law makes it so.
Replace "problem" with "legal liability" and you're probably right. It's still very much your problem, though.
Please correct me if I'm wrong, but IIRC Recall is opt-in and keeps data on-device, and doesn't share it with any other systems or parties. And if one's device is compromised, they're screwed either way (keyloggers, password managers' data, etc), so while Recall data can be an interesting target, it's not like it's some game changer. I could be wrong, but I believe first iteration was user-accessible SQLite3 database (which was an issue), but Microsoft had tightened the permissions and isolated those files, so AFAIK it now requires additional authentication to access. I don't currently use Windows, so I can't really check, but that's what I've read.
If something is opt-in, local-only and partitioned away (inaccessible to regular-user processes to avoid easier abuse by malware and exploits) that sounds like a decent privacy-respecting option to me. There are plenty of crappy anti-user moves Microsoft had pulled with Windows, but Recall doesn't seem like one to me.
Unless, of course, they're forcing this on people (like how they aggressively do with Edge and OneDrive), or pull this data somewhere despite saying they don't do it, etc etc.
For now, until Microsoft decides to silently enable it an update like they already do with all of the telemetry and similar features in Windows 10 and 11. Barring a legally binding promise that they will never reenable it without consent they are not trustworthy enough to believe on this
>And if one's device is compromised, they're screwed either way
With Recall the level of screwed we're talking can be significantly higher, because the kinds of information that can be captured are things that wouldn't necessarily be captured by other methods (and Recall will have been capturing data from before the computer was compromised too).
>but Microsoft had tightened the permissions and isolated those files, so AFAIK it now requires additional authentication to access
Which, as you yourself already mentioned, would be trivial to access because you can already put a keylogger or similar on the device to get what you need to access the Recall files.
Sure. And that's quite possible and something to be aware of. But can we agree that in its current state, it's as privacy respecting as it could be?
> the level of screwed we're talking can be significantly higher, because the kinds of information that can be captured are things that wouldn't necessarily be captured by other methods
The only difference it makes is immediately after the machine is compromised. Then - yes - after you get elevated privileges, you immediately have more information for malware to sweep. However, I've read that typical malware quietly lives on machines for a while - for months or even years. It can do its own screen recordings just fine, so it's all the same in the long run.
Let's not forget that Recall is not some malware forced on unaware people, but a legit opt-in feature with a reasonable use case - remembering things when our memory fails us. One can analyze this risk and make an informed decision if benefits overweigh the risks or not.
I have no love for Microsoft or any other big corporations, but I feel like defending this particular feature, because I do have some love for transhumanist ideals, where machines enhance and improve our capabilities - and it's one of those things I would like to have for myself. As long as Microsoft doesn't move away from opt-in and clear language, I'm on their side because they did it right (by my book) this particular time. But - of course you are correct - a caution is warranted (and that's why I don't use Windows, huh).
I read this and I think: are you the only person on Earth to never have used a Microsoft product?
OneDrive ? /s
(trust us, it is secure)
I have used Microsoft products. I have a Windows VM, and an old Windows laptop somewhere. I have no love for Microsoft, and is perfectly aware they can do user-hostile things. Yet, when analyzing something, I'm trying my best to avoid biases and remain neutral and detach from my feelings (or propaganda/ragebait/memes/whatever you call it) when I'm thinking of something. And this particular time, for this particular feature, so far, I believe they did alright.
Did you read Microsoft's privacy policy ? "Your privacy is _very important_ _for us_" ( emphasis mine) /s
If you end up with a large history of causing problems for banks they will drop you as a customer and it becomes your problem.