Microsoft Teams will soon block screen capture during meetings

* Naive screencaps are much less traceable to the leaker than a naive photo is. Yes, someone can strip out EXIF data, but we've seen over and over again that they generally don't. And even without EXIF a naive framing on the photo is more likely to expose information about the location or identity of the person who took it.

* A photo of a webinar is going to (barring serious postprocessing) look much less official and be less legible than a screenshot, so the use cases for illicit captures are going to be fewer. Few people are going to try to take a phone photo of the top-secret meeting and use the slide in their next team all-hands, but many might forget the rules and than snap a screenshot really quickly for later use.

* Just having the ability to block the easy method of screen captures helps avoid cases where the person doing the capturing isn't actively malicious, just ill-informed. If a normal employee attempts a screenshot and is reminded they're not supposed to do that, they're not going to pull out their phone to take a photo, they're going to say "oops" and move on.

Yeah, there are threat models that won't be stopped here, but most of corporate InfoSec is wrapped up in protecting against pretty lame threat models that would benefit from this—mostly uninformed/ignorant employees screwing up without intending to be a threat.

This feature provides value because it increases friction. It won't stop really determined and motivated users from leaking, but it'll make leaks, especially accidental leaks / those due to hacks, a lot less common.

The same applies to DRM, "security by obscurity", social media post editing / deletion, dark patterns, loss leaders, promotions and coupons, the list is endless.

If your user is a perfectly rational being with infinite time and infinite tech savviness, the proverbial "spherical cow", those features make 0 sense. Just like spherical cows, though, those users don't actually exist, and so friction matters.

That doesn't mean friction is infinite, though. It's too easy to overestimate it and fall into the trap of thinking that "users won't bother doing this, it doesn't matter if this combination of actions loses us money, it's too bothersome", and then get very surprised very quickly.

The people using this feature aren’t going to imagine it as 100% protective against any and all possible methods of exfiltrating data. It’s a feature for discouraging casual data capture and dissemination. It serves to remind people doing spontaneous captures that they aren’t supposed to, but everyone knows a dedicated person could find a way to get that photo if they really, really want.

That doesn’t make it useless. Every time you raise the level of difficulty for accomplishing something, a percentage of attempts are thwarted or discouraged. As it turns out in the real world, raising the bar even a little tiny bit is effective in thwarting or discouraging the majority of attempts across the average user base. You’re not defeating the dedicated attackers, but you’re reducing the overall number of successful attacks and even attempts.

The same is true for things like the office firewall blocking websites: Yes, we all know a dedicated engineer can create a way around it, but it’s going to stop most employees from getting to those sites and serve as a reminder to others that they’re not supposed to access them.

I'm an example of that threat. I'm a freelancer who often has video calls with new clients. Sometimes I surreptitiously screen cap demos or presentations. It would be very difficult to use a phone that way without breaking the conversational flow.

Other supposed workarounds would require much more preplanning. Like I'd need to know that there was something worth capturing.

This feature would help make that less likely to happen accidentally or “accidentally.” It wouldn’t stop deliberate leaks but that’s a different problem.

My company recently configured Slack for mobile to disallow copying text.

It’s all about diffusing that responsibility.

Yeah, if you've got corporate espionage going on this isn't going to stop someone from lifting your slides and taking them elsewhere. But the most common culprit of corporate information security violations isn't a spy, it's a well-meaning employee who didn't hear, remember, or correctly interpret the request to not record the meeting.

Blocking the most common way in which this kind of well-meaning but ill-informed employee would break the expected security rules does work. It's just getting flak here because people are imagining a much more exciting threat model.

It probably works as well as the company firewall blocking sites or the data exfiltration detection blocking companies from being stolen.

Everyone knows they’re not perfect and can be defeated by a sufficiently motivated attacker, but in practice they stop most casual attempts and discourage others.

Why do you think they can't prevent on-device screenshots/screen recording can't be prevented when you control the entire stack?

Asking participants not to screen record or take screenshot was standard practice at every company I’ve worked at where we discussed anything like financials or sensitive business plans.

Many people still take screenshots of things they think are useful. Things still get shared though emails and occasionally posted on social media.

I have worked with various secure chamber VPN and VNC systems that make it quite difficult to record or screenshot. These are companies where their IP is worth billions of dollars and everyone wants a piece of it. It's difficult enough that it's not worth the effort to try and work around it. The rare time I really need something for debugging, I'll take a photo with my cameraphone, but it rarely comes to that.

Because it's that much harder, I record a lot less of it. Likewise for all the other engineers I work with. Friction won't stop it entirely, but it will make it far less frequent.

That you think the only attack vector here is a 3rd party device means you haven't really considered everything. Consider screenshots that might happen for many reasons, including malicious software, or even normal software someone might be using, and accidental exposure.

It's essentially a guardrail. It can be easily circumvented if someone was being actively malicious.

Many people are babies.

Sheesh, we've come to a state where browsers can no longer be referred to as "user agents".

The resultant windoze brain damage is a co-mingling of "you don't know what you don't know", lack of awareness of just how varied computer interfaces could be, with the "child indoctrination" aspect that nothing else seems quite right when it's not what you were raised on.

After my first programming experiences, on a TRS-80 in the mall radio shack in the late '70s, I was exposed to a variety of user interfaces, but eventually became locked into windows myself, mostly from employer enforcement.

The thing that drove me away in the end was the way various settings were moved around with each new release, and the way my workflow had to constantly adapt to arbitrary changes in the user interface with each revision.

After exploring a wide variety of desktop environments, I've been on fluxbox window manager for many years now and I'm still quite satisfied. All of my configuration options are in my home directory, and my user interface experience is recreated without incident when updating, and even when moving to new h/w.

But the monoculture is wide spread, and continues to inhibit computer innovation outside of what will benefit the mothership...