It is security theater at its peak.
* Naive screencaps are much less traceable to the leaker than a naive photo is. Yes, someone can strip out EXIF data, but we've seen over and over again that they generally don't. And even without EXIF a naive framing on the photo is more likely to expose information about the location or identity of the person who took it.
* A photo of a webinar is going to (barring serious postprocessing) look much less official and be less legible than a screenshot, so the use cases for illicit captures are going to be fewer. Few people are going to try to take a phone photo of the top-secret meeting and use the slide in their next team all-hands, but many might forget the rules and than snap a screenshot really quickly for later use.
* Just having the ability to block the easy method of screen captures helps avoid cases where the person doing the capturing isn't actively malicious, just ill-informed. If a normal employee attempts a screenshot and is reminded they're not supposed to do that, they're not going to pull out their phone to take a photo, they're going to say "oops" and move on.
Yeah, there are threat models that won't be stopped here, but most of corporate InfoSec is wrapped up in protecting against pretty lame threat models that would benefit from this—mostly uninformed/ignorant employees screwing up without intending to be a threat.
for f in `ls -1 /pics/IMG_*.jpg|/usr/bin/xargs basename` ; do /usr/local/bin/magick convert $f -strip -quality 8$rand -shave 1$randx1$rand2 -resize 9$rand2% -attenuate 1.0 +noise Uniform out_$f && /usr/local/bin/exiftool -overwrite_original -all= out_$f && rm -rf $f ; done
Perhaps someone will find this useful ...
Not sure what "support" you expect for unsupported clients.
It's definitely not true that this feature breaks support for devices not owned by the manufacturer. The follow on question about whether all possible web clients / operating systems would be supported, I don't know. The article just says that web is supported.
“Web is supported” in this instance just means “the web, but only when mediated by google, microsoft or apple”, which is not the web as far as I'm concerned.
They also can prevent honest people from gathering proofs to cover or defend themselves: abusive boss, illegal requests, harassment...
I don't mean to pile on but, you wouldn't use post processing, you would just take the information out of your screenshots and make a new slide deck if you wanted pass it off as official.
Like running windows in a VM or using an HDMI capture card. And are they going to break running teams meetings when using moonlight etc. with this? If you are OBS capturing during the meeting does it get blacked out or just breaks your recording?
This is primarily about blocking accidental leaks by regular employees who were asked to not record but ignored it. This kind of reuse of content happens all the time in companies of any significant size and isn't entirely stopped by simple requests or watermarks. This tool gives companies one more option to protect against this very lame and boring but also very real threat.
i think this should not be possible to be asked.
For example, an employee might want to record to cover their own ass (e.g., if being asked to do some morally questional things, which the employee could record then use as protection against the company going back on their word).
Having the ability to _control_ whether an employee can keep records independently of the company only serves to move more control away from the employee.
I think you're seriously overestimating regular employees. A significant number of people will send you smartphone pictures when you ask for a screenshot - why would they suddenly start looking into on-device screen capture when taking a picture or video of some random presentation?
> A significant number of people will send you smartphone pictures when you ask for a screenshot
People know it’s not perfect. However, raising the bar discourages the spontaneous captures that people might try out of habit.
This feature provides value because it increases friction. It won't stop really determined and motivated users from leaking, but it'll make leaks, especially accidental leaks / those due to hacks, a lot less common.
The same applies to DRM, "security by obscurity", social media post editing / deletion, dark patterns, loss leaders, promotions and coupons, the list is endless.
If your user is a perfectly rational being with infinite time and infinite tech savviness, the proverbial "spherical cow", those features make 0 sense. Just like spherical cows, though, those users don't actually exist, and so friction matters.
That doesn't mean friction is infinite, though. It's too easy to overestimate it and fall into the trap of thinking that "users won't bother doing this, it doesn't matter if this combination of actions loses us money, it's too bothersome", and then get very surprised very quickly.
I don’t underestimate friction, I just know even my grandma would reach for her camera for a picture of her screen and she doesn’t even know what a screen capture is. It’s a stupid feature that doesn’t create friction, it just encourages users to take an untraceable action.
I would FAR prefer recording who took a screenshot than blocking it as a presenter.
The friction pushes the flow into something even worse — while not actually changing the behavior.
It would be surprising if Teams does not already capture that kind of event in its user activity event trail[0].
The amount of privacy-invasive capturing and reporting that Teams does is so staggering that it can probably rival surveillance that of North Korea on its own citizens.
[0] https://learn.microsoft.com/en-us/microsoft-365/admin/activi...
Everyone knows this. You don’t need this survey (which surely was a real thing that actually occurred and not something you just conveniently imagined for this argument, right?) to tell you that.
It’s literally written in the linked article.
We know. There are ways around it. But it’s friction, and friction has value. People know it’s not perfect, but it’s another reminder that people aren’t supposed to be doing it.
It’s a solution searching for a problem it can’t solve.
Friction implies you’re stopping a user from taking an action they consider the easiest way to solve the problem. Since you think I “invented” the survey, I invite you to ask all of you non technical friends and family how they would go about capturing an image of their computer screen if they needed to quickly show you a copy of what they’re looking at.
I absolutely guarantee you that taking a picture with their phone will be the winner by an order of magnitude.
Yes, somebody who's clever enough would keep the camera away from view, and maybe would try several times first to hold it in a way that gives a good view of the screen, etc. But this is out of scope, it's a clear malicious intent, when we could expect much more sophisticated means.
Either the information your are sharing is sensitive, or it is not. Applying friction to your colleges is just making their jobs more difficult.
The friction here is on the "unwanted" path, and in a way provides "lube" (less thinking and care) for the correct security posture.
The people using this feature aren’t going to imagine it as 100% protective against any and all possible methods of exfiltrating data. It’s a feature for discouraging casual data capture and dissemination. It serves to remind people doing spontaneous captures that they aren’t supposed to, but everyone knows a dedicated person could find a way to get that photo if they really, really want.
That doesn’t make it useless. Every time you raise the level of difficulty for accomplishing something, a percentage of attempts are thwarted or discouraged. As it turns out in the real world, raising the bar even a little tiny bit is effective in thwarting or discouraging the majority of attempts across the average user base. You’re not defeating the dedicated attackers, but you’re reducing the overall number of successful attacks and even attempts.
The same is true for things like the office firewall blocking websites: Yes, we all know a dedicated engineer can create a way around it, but it’s going to stop most employees from getting to those sites and serve as a reminder to others that they’re not supposed to access them.
For the love of God, please show an iota of acknowledgment that this could just be a matter of personal taste, instead of immediately resorting to such absolutist statement. It’s very telling that your portrayal of “I don’t like this” is “this is surely unbearable for anyone that does the sort of work that I do. Anyone that makes this work for them is doing this OTHER class of things”. And I’ve got absolutely zero doubt that you consider the things that you listed as being ‘lesser’ than your ‘real computer work’.
Casual is much easier with a phone. In Windblows to capture the screen you need to press print screen, then go to paint -> paste then save it. Paint cannot have 2 images open at the same time.
Win-Shift-S
I regularly, as do many of the people here, join meetings from my phone. I often do so so I can squeeze a run in. I especially do so in the types of all hands or large meetings where I’m in listen only mode and things are shared that would be hard to trace back to any individual in the room.
I’m not carrying a second phone to take a picture of a slide - but I regularly take screenshots in those meetings to remind myself of something or to show someone when bitching.
The relevant xkcd here is decryption by wrench (538) - the problem being solved is not battling 1337 hackers, it’s herding normally distributed loan officers at a mid regional bank.
I am not so masochistic.
I'm an example of that threat. I'm a freelancer who often has video calls with new clients. Sometimes I surreptitiously screen cap demos or presentations. It would be very difficult to use a phone that way without breaking the conversational flow.
Other supposed workarounds would require much more preplanning. Like I'd need to know that there was something worth capturing.
HDMI capture with passthrough is $20.
OP did mot solicit or show that there would be any value in people listing ways that one could circumvent this with preparation.
We all know. You aren’t adding anything to the discussion. Nerds love ignoring the cost of human effort if it gives them an opportunity to show that they know something.
There are lots of arguments I find convincing for this being effective. But not OP's. OP is saying they already do these recordings regularly, but "preplanning" would stop them? No way. They already did all the necessary preplanning by the time they finished typing their comment.
Preplanning could be meaningful for other people, but not for them and people like them.
I only mentioned price to make it clear that the level of effort to make the purchase falls within the level of effort they have already established.
I have a systemd timer that clean files older than 24h at startup because the point is not to archive content without consent.
If I ever can't do that I would just use an usb3 screen capture card and record from a second device.
This feature would help make that less likely to happen accidentally or “accidentally.” It wouldn’t stop deliberate leaks but that’s a different problem.
When we did his exit interview he admitted he just wasn’t thinking. He did it all in a couple minutes while in the meeting. Something like this would have stopped him in the process and made him remember that the content was sensitive.
Don’t underestimate the diversity of the people watching zoom meetings. It’s not all engineers with elaborate screen capture setups prepared for the express purpose of recording meetings.
If someone was going to do something dumb like that I wouldn't want them to keep their job now instead simply because the software prevented them from doing something so dumb or dangerous.
People do dumb things. The fact that it won't prevent a determined attacker isn't the point.
A big DRAFT watermark tends to clarify that far more easily and obviously.
:-D
If you wanted video just have the device positioned outside the field of view. Laptop cameras fov is very narrow.
For every 100 people who might decide to take a screenshot during a teams meeting, I doubt there’s 1 person who has all that equipment set up and ready to go. You don’t need to make something 100% effective to get a benefit from doing so.
My company recently configured Slack for mobile to disallow copying text.
It’s all about diffusing that responsibility.