If one chats/mails with a person using Windows, despite using secure private protocols, every message will be stored by Microsoft’s Windoze Recall. Either I’m missing something but this feature seems like the most grotesque breach in online privacy/security.
What are ways to avoid this except for using obfuscated text?
You must log in or # to comment.
If it leaves your device, you cannot control it.
Can’t control what other people do so you might be out of luck.
It’s more about what Microsoft enforces—spyware—than what other people do.
I meant you can’t stop then from using Recall.
This is a perfect example of why all of these privacy intrusion practices should be illegal. The same goes for services like Gmail. I use my own email server because I don’t want Google reading my messages. But it doesn’t matter, because everyone else uses Gmail, so any time I communicate with someone, Google reads my emails, despite the fact that I never agreed to their oppressive ToS. It’s a blatant violation of our right to privacy.
It is the same with Google Fonts. Everyone uses them, so your browser will have to ping Google Servers to get them. Even blocking them, puts you in a smaller bin of users since most people do not block them, which can help them profile you.
I got lucky and forced everyone I keep mostly on touch away from Gmail and into either my Nextcloud instance chat and/or Signal, XMPP or Delta Chat. Which are on mobile.
Another user mentioned PGP, great in theory, but most people I know do not use it and will not touch it. They think it is too complicated, which is not. But people are lazy if they do not care about privacy. I got lucky that I made most switch.
That’s a great point about the fonts. And Google Analytics, and AdSense, and their jQuery CDN. They have a whole lot of ways to inject their tracking into every site out there.
But it doesn’t matter, because everyone else uses Gmail, so any time I communicate with someone, Google reads my emails, despite the fact that I never agreed to their oppressive ToS.
That’s avoidable by PGP encrypting your emails though. But I’m sure you know that, and I’m sure you meant that getting most people to use PGP is a pipe dream.
Even if you got them using PGP somehow, there’s always a risk. Apps designed to upload screenshots, share contacts or simple human errors like “hey did you hear X saying Y”, etc.
Yes, but Recall is spyware by design posing as a benign feature. This kind of unethical behaviour I vehemently oppose.
Turn off your computer, move to a cave in the mountains, and abandon society.
A bit extreme but there is nothing you can do to stop your messages from appearing on Windows machines except not sending them to anyone who might view them on Windows machines…which will definitely be nearly impossible in 2024
Works great until some hikers take a photo with you in the background, that gets backed up to iCloud, then they want to show the photo to a friend, download it to their computer, open it and BOOM, Microsoft AI knows your face
I couldn’t wait to post this obligatory fragment of Parks and Recreation - Ron vs. Online Privacy: https://youtu.be/8xn1rO1oQmk
Wow, valid issue.
Spitballing, potentially a secure app could run memory only, blah, blah, blah. Nope, you’ve given M$ your screen FFS, it’s all over. If you care, move elsewhere, tell your friends…
As you point out, codes are an option, but it’s not a slippery slope, it’s a waterslide.
So is there a way for businesses to disable this garbage feature through managed device settings or something? I’m guessing corporate legal departments aren’t going to be too thrilled with this feature.
It can be turned off so it’s up to the person you’re messaging. Once you send something the person at the other end is in control of what happens to it.
Once you send something the person at the other end is in control of what happens to it.
True, but this is the beauty of trust. I decide to communicate one way or another with someone depending on the level of trust. Them deciding to break that trust is a risk I chose to take. However, I do not choose to communicate with Microsoft, whatsoever. Windows Recall is the most blatant piece of spyware ever; beyond comprehension how this is so normalized.
Then you have to trust the person you are communicating with has turned off windows recall. That has to be the starting position.
Tools will come to block or break windows recall but it will still be based on trust that the recipient is using them. Privacy centred apps like Signal wouldn’t want windows screen shotitng every message for example. There are many apps and tools including in the professional sphere that would not want their data leaking via recall so it will come.
Unfortunately it may come late in the professional realm probably after scandals break. Employers using recall data to investigate staff for example - it’s bound to happen eventually.
My own organisation, a huge health organisation, has opted in to CoPilot. It’s crazy in my view, even if our data is ring fenced in some way. I don’t want private patient information being used to train Microsoft shitty tools, or stored on their servers. Regulation and the law is way behind when it comes to this stuff.
You have to trust the person you’re communicating with has turned it off. That’s my point. It’s an optional feature
If there’s anything sensitive I’m communicating with someone digitally, I make sure that the person in question has basic tech security skills and knowledge about privacy, including telling them to stop using Windows. Including taking the time to teach them basic stuff (like full disk encryption, VPN and Tor usage, explaining E2EE, etc) myself. If you have a high threat model but are talking to non-techy people, you should be taking the time out of your day to do this.
If you’re thinking “wow I can’t be bothered to do all that”, your messaging is probably not sensitive enough for this to be a significant concern. Not that “if you have nothing to hide you have nothing to fear”, but just “the amount of time you put into security and privacy should be proportionate to your threat model and the cost of compromise”.
You must start spreading libre software effectively. You don’t control their device. You mist show them how to fix it.
Last year I did so by writing the essay “What if I paid for all my free software?” It came across well. Now I’m thinking of ways to reach a broader audience in order to not only be preaching to the choir.
I would focus on those directly around you first (not online strangers) and showing them by example to do the same, like my last post. Rather than telling them, find ways to make them want to ask you themselves. Make them start the conversation.
Rest assured, I do that too ;)
I’m in Europe :p
I’m afraid this comment shows a severe underestimation of the gravity of the issue. Windows recall doesn’t stop at borders even if it were illegal there.
Well, it’s not here yet. And I do use windows 11, as does my mom, my grandparents and other pc’s I’m the one helping with. I don’t recall any recalls :p
And if they do push it here, it’s probably followed by a news headline “eu fined Microsoft 10 billion for gdpr violation” or something like that
EU fines take way longer then that, give it a couple years of data collection and if we’re lucky they get fined
Their warnings tend to be a bit quicker
