Hacker News Reader

Comment by NKosmatos | Hacker News Reader

LOL Another stupid feature (enforced by regulations/law/policies) that has no real world use, besides making us users angry :-(

Like Google collecting all of our location history for their own usage, but not allowing us to see it via web anymore (only on mobiles), or having the android dialer not allowing us to record our own phone conversation (easily circumvented), or movie/music/game publishers not allowing us to backup our own media… you get the point.

All these are due to laws and regulations that are there to protect the big companies and don’t take into consideration users and the common sense ;-)

View on HN

> All these are due to laws and regulations that are there to protect the big companies and don’t take into consideration users

This feature is not due to laws and regulations.

The user in this case is the presenter who clicks the button to enable screenshot protection on their meeting. This is Microsoft trying to deliver a feature their users want, not laws and regulations making them do something their users don’t want.

Some people might want it, but it doesn’t actually work. It’s probably also required by some compliance theater in some places.

> Some people might want it, but it doesn’t actually work

Why do you think they can't prevent on-device screenshots/screen recording can't be prevented when you control the entire stack?

Would it work on Mac?

Yes.

Edit: But yeah, nothing to say why it can't work. So, yeah.

But MS doesn’t control the whole stack there.

Apple provides APIs to do it.

Doesn’t matter. I don’t know why you think stating random things matters.

Maybe read the comment I replied to for context?

It's kind of like locks isn't it? It'll deter honest folks, but will it prevent screen capture when Teams is running in a VM? What about over VNC?

What about a camera?

These aren't the use cases that really matters. What matters is the common case, and it's not about deterring honest folks. Honest folks aren't recording.

This is really a lesson in security blind spots. The number of people that are trying to "get around this" assuming that's the issue.

Edit: I'll make it simple. It will work because honest people aren't trying to get around it. But, they could still expose data they shouldn't. This helps prevent that. Again, a camera is enough to prove it doesn't need to be 100% perfect (and probably more honest considering screenshots can be faked).

So, instead of trying to think of how you can exploit, think of all the ways this private information can get out when it shouldn't and the people on the call aren't trying to release it. Work through that, and see where you get.

> Honest folks aren't recording.

Honest folks who want to be able to cover their ass later on are.

Honest folks who are working for dishonest people and are planning to be a whistleblower are.

Honest folks who have Recall on are. Possibly against their will if they haven't found out how to turn it off, or it's a work machine where they're not allowed to do so. Maybe they're not if Microsoft actually has enough interdepartmental communication for the "no screenies please" signal to make it all the way to Recall. It'll be hilarious if they don't.

One of the best rules I ever heard of was told to me by a cop here in Australia. She told me every time they unholster their firearm, they have to fill out about 3 pages of paperwork. I think that’s so genius.

Think about it - if you’re in a life or death situation, you won’t hesitate. Your gun is right there, and it’s there so you can use it. But if the situation doesn’t feel dangerous, the image of having to fill out 3 pages of paperwork justifying your actions is enough to make you hesitate. It’s weaponised bureaucracy. It’s like - there’s an ideal amount of friction for some actions to have. Pulling your gun out should have some friction to it. The choice should have weight.

I see this in just the same way. If the presenter doesn’t want their presentation recorded, there should be some friction to recording it anyway. It shouldn’t be impossible to record. But it shouldn’t be as easy as just taking a screenshot in windows.

Just like that cop with a gun, there should be the right amount of friction for recording a meeting against the wishes of the presenter. How many pages did the cop have to fill out? 3 pages. Not zero. Not 100 pages. How hard is it to record a meeting despite this protection? It’s doable - you need an hdmi capture card, or a camera out of shot, or something else. You probably need to set it all up before the meeting. And so on. It’s not impossible. But it’s not trivial either. That sounds just right to me.

3 pages of paperwork are like 5 minutes of work tops.

And in all those cases they still have a solution, a better solution. Seriously, think.

> It will work because honest people aren't trying to get around it.

I think this makes the counterargument even stronger.

Let's take for granted that this isn't intended to stop a determined leaker and is just meant to prevent honest, unintentional mistreatment of sensitive data.

The question is whether the false positives outweigh the true positives. This feature will impede people from getting things done in subtle but annoying ways (making it more difficult to take notes, hurting accessibility, etc). It's likely that when this is widely deployed, many big orgs are going to overuse it and enable it as a matter of course to prevent liability. Those scenarios where honest people are blocked from doing honest things for which there's no harm are the false positives in this scenario -- there was no need to prevent those scenarios, but they were prevented anyway.

Now consider the true positives: we've agreed that intentional malice is not covered by this feature, and so the true positives are limited just to the smaller subset of scenarios in which honest people unintentionally mistreat sensitive data, and don't include any scenarios where data is being intentionally leaked.

I suspect the number of scenarios that fall into the false positive category will be much greater than the number of scenarios that fall into the true positive category, especially so after intentional malice is excluded. So is this really a net win for anyone?

>VM

Yes, it will not be capturable. If the VM is not secure it will not display it.

>VNC

The VNC server will not be able to capture it.

I haven’t had that experience when the same mechanisms were used to prevent screen sharing streaming video.

I just fired up a linux vm, and hit play.

If this thing actually breaks machines that don’t have a properly configured hdcp chain, it’ll create insane “this meeting is broken” debugging scenarios.

Also, hdcp is trivially bypassed these days (if, for some reason a camera phone recording of the damning meeting isn’t enough, and a perfect digital copy is needed…)

>hdcp is trivially bypassed these days

Old versions of it.

They can't control the entire stack because of the analogue hole

Which doesn’t matter at all.

I'm just answering your question.

Yeah, some enterprise admin will click it and make it clickable for others. It’s a classic ratchet of enshittification until things reach a magic intolerability point and folks evacuate to other systems leading those to get rolled into one of the borgs: lather, rinse, repeat.

It doesn't work against which threat model?

Yeah, if you've got corporate espionage going on this isn't going to stop someone from lifting your slides and taking them elsewhere. But the most common culprit of corporate information security violations isn't a spy, it's a well-meaning employee who didn't hear, remember, or correctly interpret the request to not record the meeting.

Blocking the most common way in which this kind of well-meaning but ill-informed employee would break the expected security rules does work. It's just getting flak here because people are imagining a much more exciting threat model.

It doesn’t work against employees with camera phones.

> Some people might want it, but it doesn’t actually work

It probably works as well as the company firewall blocking sites or the data exfiltration detection blocking companies from being stolen.

Everyone knows they’re not perfect and can be defeated by a sufficiently motivated attacker, but in practice they stop most casual attempts and discourage others.

There isn’t a single user (presenter) that would ask something like this. Only a presenter that has to follow some strict “high security” procedures would enable something like this. A politician, for example, will have an excuse in case something leaks. The fact that with a simple mobile having a camera you can copy whatever is being presented (or with slightly more technical ways) is irrelevant for laws and procedures ;-)

You don’t get invited to the right meetings, I see.

You mean with people who have more paranoia than sense?

> There isn’t a single user (presenter) that would ask something like this.

Asking participants not to screen record or take screenshot was standard practice at every company I’ve worked at where we discussed anything like financials or sensitive business plans.

Pretty common where I have worked. Most commonly when reviewing internal product roadmaps to our sales teams because we've burned too many times when customers complain that we haven't implemented something we never announced but a sales person mentioned/showed.

You think forbidding screenshots is going to stop salespeople from promising random stuff? Have you met salespeople?

> The fact that with a simple mobile having a camera you can copy whatever is being presented (or with slightly more technical ways) is irrelevant for laws and procedures ;-)

That you think the only attack vector here is a 3rd party device means you haven't really considered everything. Consider screenshots that might happen for many reasons, including malicious software, or even normal software someone might be using, and accidental exposure.

If you have a camera on a stand or are holding up a phone, other participants will able to see it and object. Of course it's still possible to get around it. It's possible to get around anything. The idea of privacy controls is to make bad-faith jerks have to work significantly harder.

Cameras are in eyeglass frames now. Or lapel pins. The idea that someone would be noticed taking pictures is pretty obsolete.

You can certainly get cameras like that, they're not the norm. You can object to any privacy feature by pointing out that it doesn't provide guaranteed security. Personally I am tired of having my privacy eroded by people holding themselves out as security realists who are always coming up with new ways to break things and/or normalizing existing ones.

Every meeting I'm in where we talk numbers or strategy starts with someone saying, Please don't record or share this. The documents all say CONFIDENTIAL all over them. That's not true of all our presentations, just ones that we really wouldn't want our competition to see.

Many people still take screenshots of things they think are useful. Things still get shared though emails and occasionally posted on social media.

I have worked with various secure chamber VPN and VNC systems that make it quite difficult to record or screenshot. These are companies where their IP is worth billions of dollars and everyone wants a piece of it. It's difficult enough that it's not worth the effort to try and work around it. The rare time I really need something for debugging, I'll take a photo with my cameraphone, but it rarely comes to that.

Because it's that much harder, I record a lot less of it. Likewise for all the other engineers I work with. Friction won't stop it entirely, but it will make it far less frequent.

But it’s literally the dumbest feature ever. There’s absolutely nothing preventing a user from pulling out their phone and taking a picture of any slide they want. Or having a camera recording the whole session out of view of their webcam.

It is security theater at its peak.

In a 1:1 format this would be effective in preventing some forms of misuse because it would be obvious if an individual took out their phone and pointed it towards the screen.

Easily circumvented: Use two monitors, one positioned out of view. Use a teleprompter mirror with a camera behind the mirror. Use a video capture device, record on a separate computer. I'm sure there's sneakier ways to perform this...

Your “easy” circumvention requires a second monitor, a teleprompter mirror, a camera, a separate computer and a video capture device. Remember, most people who use Teams don't work in tech. And for them, that’s not “easy”. Barely any normal people have that kind of equipment just lying around, along with the expertise and desire to set all that up, ready for a teams meeting.

For every 100 people who might decide to take a screenshot during a teams meeting, I doubt there’s 1 person who has all that equipment set up and ready to go. You don’t need to make something 100% effective to get a benefit from doing so.

These comments are akin to pointing out that the privacy door on a public bathroom stall can easily be bypassed by looking over the top of the stall walls or underneath the gap between the ground and the bottom of the wall. In their rush to be clever, they instead demonstrate that the poster completely missed the point.

You turn your camera off for 10 seconds, take the photo and turn the camera back on. No-one would notice a thing

If you wanted video just have the device positioned outside the field of view. Laptop cameras fov is very narrow.

Sibling comment's definition of "easily" varies materially from my own!

but it is so easy to circumvent, even my teenage daughter, who doesn't have an interest in tech, knows what a capture card is and knows what an hdmi splitter is: she hasn't even entered the workforce yet and she already has all the ingredients needed to circumvent a software block on screenshots

:-D

It's not pure security theater, there are a few clear gains for those who care about such things:

* Naive screencaps are much less traceable to the leaker than a naive photo is. Yes, someone can strip out EXIF data, but we've seen over and over again that they generally don't. And even without EXIF a naive framing on the photo is more likely to expose information about the location or identity of the person who took it.

* A photo of a webinar is going to (barring serious postprocessing) look much less official and be less legible than a screenshot, so the use cases for illicit captures are going to be fewer. Few people are going to try to take a phone photo of the top-secret meeting and use the slide in their next team all-hands, but many might forget the rules and than snap a screenshot really quickly for later use.

* Just having the ability to block the easy method of screen captures helps avoid cases where the person doing the capturing isn't actively malicious, just ill-informed. If a normal employee attempts a screenshot and is reminded they're not supposed to do that, they're not going to pull out their phone to take a photo, they're going to say "oops" and move on.

Yeah, there are threat models that won't be stopped here, but most of corporate InfoSec is wrapped up in protecting against pretty lame threat models that would benefit from this—mostly uninformed/ignorant employees screwing up without intending to be a threat.

> Yeah, there are threat models that won't be stopped here

Like running windows in a VM or using an HDMI capture card. And are they going to break running teams meetings when using moonlight etc. with this? If you are OBS capturing during the meeting does it get blacked out or just breaks your recording?

You don't need to elaborate on mechanisms for bypassing because you're already imagining a threat actor that is out of scope.

This is primarily about blocking accidental leaks by regular employees who were asked to not record but ignored it. This kind of reuse of content happens all the time in companies of any significant size and isn't entirely stopped by simple requests or watermarks. This tool gives companies one more option to protect against this very lame and boring but also very real threat.

And also gives legal teams more foundation to stand on, bypassing this isn't trivial so it shows real intent

"isn't trivial"? When the sibling comment mentions how a lot of employees will by default use a camera when asked for a screenshot?

By "isn't trivial", I mean that takes real effort on the user end to bypass (as they can't simply take screenshots in traditional methods). Bad choice of word on my end

They have absolutely no way to enforce anything of sorts on linux, technically.

A typical corporate workspace won't have any employees running Linux on their work machines.

That is not my experience in the last 10 years.

> This is primarily about blocking accidental leaks by regular employees who were asked to not record but ignored it.

I think you're seriously overestimating regular employees. A significant number of people will send you smartphone pictures when you ask for a screenshot - why would they suddenly start looking into on-device screen capture when taking a picture or video of some random presentation?

  > A significant number of people will send you smartphone pictures when you ask for a screenshot

n=1 but this is also my experience at $JOB for a majority of times for me as well

I already addressed this possibility in my first comment. Points 1+2.

> regular employees who were asked to not record

i think this should not be possible to be asked.

For example, an employee might want to record to cover their own ass (e.g., if being asked to do some morally questional things, which the employee could record then use as protection against the company going back on their word).

Having the ability to _control_ whether an employee can keep records independently of the company only serves to move more control away from the employee.

Trade secrets are a thing. Legal requirements are a thing as well. In some cases (think HIPAA) an employee recording something that they're shown can translate to significant legal liability for both themselves and the company.

The easiest one is already mentioned in the article: Someone pulling out their phone and snapping a photo.

People know it’s not perfect. However, raising the bar discourages the spontaneous captures that people might try out of habit.

>A photo of a webinar is going to (barring serious postprocessing) look much less official

I don't mean to pile on but, you wouldn't use post processing, you would just take the information out of your screenshots and make a new slide deck if you wanted pass it off as official.

Good summary. It's best to think of controls like this as guardrails. They are mostly "safety" features rather than hard-core security features. They help honest people to avoid potentially dangerous mistakes.

Guardrails that break support for devices that aren't owned by the equipment manufacturer, yeah, about that…

It doesn't do anything of the sort. It will work on PCs, Web, Android and iOS - everything with a supported client.

Not sure what "support" you expect for unsupported clients.

Will it though? If I join from Linux using Ferdium or any other browser what will prevent me from using any screenshooter? Or will web be considered an unsupported platform?

The article says web is supported. Whether that means all browsers or just some, no idea.

Perhaps a little less snark would be appropriate if you don't know what other people are talking about.

Apologies if I came across snarky, not my intention.

It's definitely not true that this feature breaks support for devices not owned by the manufacturer. The follow on question about whether all possible web clients / operating systems would be supported, I don't know. The article just says that web is supported.

This isn't “we haven't tested your browser, if it breaks, that's on you”, this is “we don't specifically Trust™ the environment you're running your browser in, therefore fuck you.”

“Web is supported” in this instance just means “the web, but only when mediated by google, microsoft or apple”, which is not the web as far as I'm concerned.

Hmmmm, I use Firefox on Linux to access Teams currently. Guess we'll see if that breaks.

Of course it's going to break. Remember when they built an actual Teams client for Linux? Remember how much Microsoft <3 Linux? Yeah, you're fucked buddy.

Oh well, I'll use something else then. Not worth getting upset about really.

Nothing that doesn't require a chain of Trust™ to the operating system will work, which is the point at which I start to get upset.

> They help honest people to avoid potentially dangerous mistakes.

They also can prevent honest people from gathering proofs to cover or defend themselves: abusive boss, illegal requests, harassment...

You can always use your phone to record it if there's some overriding reason to break the confidentiality protection. Or have a witness be present during a call (maybe out of sight).

What's the endgame here? Mandatory HDCP monitors for meetings? HDCP for absolutely every application?

"Yes, someone can strip out EXIF data, but we've seen over and over again that they generally don't. And even without EXIF a naive framing on the photo is more likely to expose information about the location or identity of the person who took it."

  for f in `ls -1 /pics/IMG_*.jpg|/usr/bin/xargs basename` ; do /usr/local/bin/magick convert $f -strip -quality 8$rand -shave 1$randx1$rand2 -resize 9$rand2% -attenuate 1.0 +noise Uniform out_$f && /usr/local/bin/exiftool -overwrite_original -all= out_$f && rm -rf $f ; done

So ... not just stripping the exif/meta data but also dropping the quality to 8[0-9]%, shaving a random number of pixels from the border, resizing by 9[0-9]% and adding some noise to the image.

Perhaps someone will find this useful ...

not the people being referenced. You are the 1%.

I’ve been on calls where a presenter explicitly asks that people not screenshot slides shown in the meeting because they’re drafts that will be refined and published or circulated later on. Some companies probably have that as a blanket policy. I’m sure this isn’t universally followed.

This feature would help make that less likely to happen accidentally or “accidentally.” It wouldn’t stop deliberate leaks but that’s a different problem.

We once had an intern who took screenshots of an internal presentation and posted them on the internet to brag about how cool his internship was.

When we did his exit interview he admitted he just wasn’t thinking. He did it all in a couple minutes while in the meeting. Something like this would have stopped him in the process and made him remember that the content was sensitive.

Don’t underestimate the diversity of the people watching zoom meetings. It’s not all engineers with elaborate screen capture setups prepared for the express purpose of recording meetings.

Seems like you will now have 1 less way to weed out an employee you don't want...

If someone was going to do something dumb like that I wouldn't want them to keep their job now instead simply because the software prevented them from doing something so dumb or dangerous.

Thank you Hacker News commenter for lecturing someone on Human Resources policy. The ultimate scope creep from someone explaining why this feature might have an iota of value. The SECOND a tool that you use add a feature that you want because “um, we don’t think that your business should work like that, actually”, there’d be an angry rant on the front page of this very site.

Yes, this is a great example of why a control like this is useful.

People do dumb things. The fact that it won't prevent a determined attacker isn't the point.

recording a call is not attacking duh.

because they’re drafts that will be refined and published or circulated later on

A big DRAFT watermark tends to clarify that far more easily and obviously.

But its not really a draft, they just want to reserve the right to change their mind some time later if there is any blowback :)

That’s because what the users want isn’t actually being secure. They want to be able to say they did everything in their power to stop people from capturing sensitive info.

It’s all about diffusing that responsibility.

It reduces the risk, it doesn't completely eliminate it, and that's fine. Not everything was to be 100%.

I think I’m just fundamentally against any corporate functionality that reduces the employees to grade schoolers.

Nah, this would stop a lot of threats.

I'm an example of that threat. I'm a freelancer who often has video calls with new clients. Sometimes I surreptitiously screen cap demos or presentations. It would be very difficult to use a phone that way without breaking the conversational flow.

Other supposed workarounds would require much more preplanning. Like I'd need to know that there was something worth capturing.

RDP into computer that has meeting running and then screenshot from the external computer running RDP .

Yep, I already covered workarounds that would be possible with preplanning.

If you already do it regularly, then the preplanning is not a big barrier. You already know that you keep getting into situations where something is worth capturing.

HDMI capture with passthrough is $20.

Are you genuinely not reading the comments that you’re replying to?

OP did mot solicit or show that there would be any value in people listing ways that one could circumvent this with preparation.

We all know. You aren’t adding anything to the discussion. Nerds love ignoring the cost of human effort if it gives them an opportunity to show that they know something.

I'm definitely reading the comments. I'm replying to a very specific comment that made a very specific argument.

There are lots of arguments I find convincing for this being effective. But not OP's. OP is saying they already do these recordings regularly, but "preplanning" would stop them? No way. They already did all the necessary preplanning by the time they finished typing their comment.

Preplanning could be meaningful for other people, but not for them and people like them.

I only mentioned price to make it clear that the level of effort to make the purchase falls within the level of effort they have already established.

Preplannig? As in putting your phone in front of your keyboard and hitting record?

I record all my calls with OBS because I know sometimes my mind drift off especially when people are going off topic for a while or part of the call is not relevant to me and I want to be able to get back to it if I missed something important.

I have a systemd timer that clean files older than 24h at startup because the point is not to archive content without consent.

If I ever can't do that I would just use an usb3 screen capture card and record from a second device.

Or use an hdmi capture card.

Nothing, /yet/

just because it isn't perfect doesnt mean it's "dumbest". snapchat, 4chan, etc. will foil 99% of users, who don't think to take/are incapable of taking that next step.

It helps to prevent accidental sharing of confidential information.

There are two kinds of people in the world, those who completely misunderstand the value of friction, and those who depend on friction too heavily; GP clearly falls into the former group.

This feature provides value because it increases friction. It won't stop really determined and motivated users from leaking, but it'll make leaks, especially accidental leaks / those due to hacks, a lot less common.

The same applies to DRM, "security by obscurity", social media post editing / deletion, dark patterns, loss leaders, promotions and coupons, the list is endless.

If your user is a perfectly rational being with infinite time and infinite tech savviness, the proverbial "spherical cow", those features make 0 sense. Just like spherical cows, though, those users don't actually exist, and so friction matters.

That doesn't mean friction is infinite, though. It's too easy to overestimate it and fall into the trap of thinking that "users won't bother doing this, it doesn't matter if this combination of actions loses us money, it's too bothersome", and then get very surprised very quickly.

I work in security. I have had customers request this feature. I have asked them to do an anonymous survey of users to ask what action they would take if they were blocked from taking screenshots and users universally say they’d take a picture of their screen with their phone.

I don’t underestimate friction, I just know even my grandma would reach for her camera for a picture of her screen and she doesn’t even know what a screen capture is. It’s a stupid feature that doesn’t create friction, it just encourages users to take an untraceable action.

I would FAR prefer recording who took a screenshot than blocking it as a presenter.

Also, the screenshot stays within your corporate network, whereas the photo is immediately backed up to iCloud, sent over messenger, etc.

The friction pushes the flow into something even worse — while not actually changing the behavior.

> I have asked them to do an anonymous survey of users to ask what action they would take if they were blocked from taking screenshots and users universally say they’d take a picture of their screen with their phone.

Everyone knows this. You don’t need this survey (which surely was a real thing that actually occurred and not something you just conveniently imagined for this argument, right?) to tell you that.

It’s literally written in the linked article.

We know. There are ways around it. But it’s friction, and friction has value. People know it’s not perfect, but it’s another reminder that people aren’t supposed to be doing it.

It’s literally not friction. The average user has no clue how to take a screenshot. They all know how to take a picture with their phone.

It’s a solution searching for a problem it can’t solve.

Friction implies you’re stopping a user from taking an action they consider the easiest way to solve the problem. Since you think I “invented” the survey, I invite you to ask all of you non technical friends and family how they would go about capturing an image of their computer screen if they needed to quickly show you a copy of what they’re looking at.

I absolutely guarantee you that taking a picture with their phone will be the winner by an order of magnitude.

Taking out a camera to make a picture is pretty noticeable in a meeting with few participants. The standard way to use a phone camera involves lifting it pretty close to your eye level. Other participants could literally shout to please stop photographing the screen. It will be also very visible who was trying to do so.

Yes, somebody who's clever enough would keep the camera away from view, and maybe would try several times first to hold it in a way that gives a good view of the screen, etc. But this is out of scope, it's a clear malicious intent, when we could expect much more sophisticated means.

I'm not sure what scenario you're imagining, but Teams is mainly for remote meetings.

I think he meant that in a meeting of few people, all with cameras on, a participant can't simply raise his phone and take a picture.

People turn their cameras off for a few minutes all the time. And it’s not like people can’t fiddle with their phones out of frame.

> I would FAR prefer recording who took a screenshot than blocking it as a presenter.

It would be surprising if Teams does not already capture that kind of event in its user activity event trail[0].

The amount of privacy-invasive capturing and reporting that Teams does is so staggering that it can probably rival surveillance that of North Korea on its own citizens.

[0] https://learn.microsoft.com/en-us/microsoft-365/admin/activi...

How exactly did you phrase the question? It's one thing to ask about a purely technical limitation. A different (and more relevant) question would be: if law or company rules prohibit you from recording or taking screenshots in some specific circumstances, and software is helping enforce that, what would you do?

A smartphone is amazingly low friction.

I think using the word friction is good. If you want your business to run smoothly you should not apply friction. In-fact, you should be looking for places where there is fiction and apply lube.

Either the information your are sharing is sensitive, or it is not. Applying friction to your colleges is just making their jobs more difficult.

Using your analogy one should lube the brake pads, after all friction is bad, isn't it?

The friction here is on the "unwanted" path, and in a way provides "lube" (less thinking and care) for the correct security posture.

I think it’s funny that so many of these comments assume the person clicking the “enable screenshot protection” checkbox will be unaware that participants might have camera phones. It’s equally funny to read the comments imagining participants with elaborate pre-built workarounds like hidden pinhole cameras or pre-configured HDMI splitters going into full-screen video capture on another system.

The people using this feature aren’t going to imagine it as 100% protective against any and all possible methods of exfiltrating data. It’s a feature for discouraging casual data capture and dissemination. It serves to remind people doing spontaneous captures that they aren’t supposed to, but everyone knows a dedicated person could find a way to get that photo if they really, really want.

That doesn’t make it useless. Every time you raise the level of difficulty for accomplishing something, a percentage of attempts are thwarted or discouraged. As it turns out in the real world, raising the bar even a little tiny bit is effective in thwarting or discouraging the majority of attempts across the average user base. You’re not defeating the dedicated attackers, but you’re reducing the overall number of successful attacks and even attempts.

The same is true for things like the office firewall blocking websites: Yes, we all know a dedicated engineer can create a way around it, but it’s going to stop most employees from getting to those sites and serve as a reminder to others that they’re not supposed to access them.

The funniest part to me is these comments exclude something even more basic: joining a teams meeting on your phone. Notice the platforms mentioned ITA?

I regularly, as do many of the people here, join meetings from my phone. I often do so so I can squeeze a run in. I especially do so in the types of all hands or large meetings where I’m in listen only mode and things are shared that would be hard to trace back to any individual in the room.

I’m not carrying a second phone to take a picture of a slide - but I regularly take screenshots in those meetings to remind myself of something or to show someone when bitching.

The relevant xkcd here is decryption by wrench (538) - the problem being solved is not battling 1337 hackers, it’s herding normally distributed loan officers at a mid regional bank.

> joining a teams meeting on your phone

I am not so masochistic.

True. But if you start putting these speed bumps everywhere, suddenly the platform become a hell to use when you need to do/use/operate something. It is one of the reason why I moved from macOS or Linux despite really wanting to operate a macbook. macOS has become unbearable unless all you did for a living was videos, audio and normal web browsing.

I don’t do “video, audio, and normal web browsing” for a living, and I don’t find macOS unbearable.

For the love of God, please show an iota of acknowledgment that this could just be a matter of personal taste, instead of immediately resorting to such absolutist statement. It’s very telling that your portrayal of “I don’t like this” is “this is surely unbearable for anyone that does the sort of work that I do. Anyone that makes this work for them is doing this OTHER class of things”. And I’ve got absolutely zero doubt that you consider the things that you listed as being ‘lesser’ than your ‘real computer work’.

> It’s a feature for discouraging casual data capture and dissemination

Casual is much easier with a phone. In Windblows to capture the screen you need to press print screen, then go to paint -> paste then save it. Paint cannot have 2 images open at the same time.

Psst.

Win-Shift-S

> But it’s literally the dumbest feature ever.

My company recently configured Slack for mobile to disallow copying text.

That's frustrating. Can you can still, if you have Android, use the text capture feature built in that reads text from bitmaps? I use that everyday for sites and apps that don't allow copy paste.

This was part of a larger security policy change that also dropped support for my phone manufacturer so I couldn't say.

I use localslackirc. It logs deletions as well.

Please stop moving the goalposts. It makes it even more blatant that you’re engaging in a kneejerk emotional argument that doesn’t belong on this website.

But just wait until all consumer image display and capture devices start using invisible-to-the-naked-eye watermarking and content protection, only allowing you to photograph sources which have explicitly granted permission to be photographed. :-)

It prevents some accidental recording, which has value.

hahaha nobody asked for this

You have no idea. Infosec in my company would ask for this.

I think he meant "nobody with sense"

It's a mundane corporate feature request and quite reasonable and valid.

Yeah, because blocking screenshots is security. How dumb could the world get? If you have sensitive information and a committed individual to leak those, then there is no way around if the picture is shared. What is next?

Startup idea: i-Secure. Your camera can only take/show photos of approved targets. All photos will be analyzed for safety. Unapproved/Unlocked camera devices from China are now illegal.

It's a pointless and stupid feature. It's trivial to take a picture of the screen with your phone.

It's about convenience. You would be surprised how much information is leaked simply because it was so convenient to.

stupid security theater liket his makes everything less secure.

people who used to take screenshots will now resort to taking screen pictures with their phones. this means microsoft teams is incentivizing everyone to 'leak' content outside of corporate networks.

creating a unworkable 'secure' system causes ordinary people to to go around the security to get their job done. which makes everything less secure in the end.

What's really going to happen is IT people will enforce this by default because good users aren't supposed to take screenshots, apparently.

I am a sysadmin and we will enable this. This is because many meetings discuss confidential or strictly confidential information that must not be leave the meeting. In-house, you would simply hand out papers that you collect before concluding the meeting. In Teams meeting it's not possible hence you block people from creating screenshots. This requirement comes from legal and compliance, and many other positions from CEO downwards.

If you don't frisk people to check if they have microphones and make everyone leave their phones at the entrance, you're just wasting everyone's time.

Information hasn't leaked because people didn't bother to leak it, not because of your security measures.

The lede you're burying here is why a lot of this confidential info is so. Yes, protecting IP is important, but you're also primarily targeting whistle-blowers, abused employees, discriminated against employees, etc.

I mean, if HR says they won't make an accommodation because they think you're faking your disability than it's as if it never happened. Less transparency always benefits the immoral.

And this type of stuff does happen. A lot. We don't hear about it because:

1. Companies have gotten really good at just covering their tracks, like this.

2. It's a lot of effort to fight back and it's almost never worth it. You pretty much need baby killing material for someone to whistle blow. Lowly transgressions like discrimination aren't worth the effort.

I thought after Blizzard this would be a sort of wake up call.

> to enable screenshot protection on their meeting

Nobody forces them to make a presentation. They can always spend their time doing something else.

AFAIK, Google stopped making Timeline accessible on the web in favor of local-first storage to avoid having to give location data when subpoenaed by law enforcement (since they can't give away data they literally don't have access to). And they didn't want to deal with the headache of user privacy-related lawsuits, so they defaulted Google accounts into auto-deleting location history (which was already opt-in for years).

I could not figure out how to record phone calls on Android! No app worked. I know it is forbidden in the EU, but I forget so many important details from calls that this would be very important.

GrapheneOS allows call recording. I believe LineageOS also allows.

This is why I advocate for International DCO EPO day!

Because if we shut it all down, a huge chunk won’t start up, and humanity gains huge amounts of electricity generation back, but somewhat more importantly: maybe we could stop carrying smartphones!

(This is mostly in jest, here’s a “/s” for those who can’t tell)

Don't know why Android doesn't allow you to record the call with the dialer. Google voice on the other hand allows this. Just hit 4 and you call is recorded. It is announced to all parties however.

The workaround for that was to press 4 as soon as the ringing started. Obviously this doesn't apply when receiving calls.

Lets blame laws and regulations for features private companies decide to implement, because I guess that will help us destroy the state.

Stop making up laws and regulations that dont exist.

> phone conversation (easily circumvented)

Well, is there a reliable way to circumvent it without using a separate device? I cannot find anything that would just work on Android and not be paid.

Or image search not identifying people which was actually kind of useful. But I understand the downside.

> easily circumvented)

Or, you know, just take a picture of the screen with your phone.

Or record the session, or film it, etc etc etc

And what is the point? If I want to capture something, I can use my cellphone even if print-screen is not working.

Reply on news.ycombinator.com