If one chats/mails with a person using Windows, despite using secure private protocols, every message will be stored by Microsoft’s Windoze Recall. Either I’m missing something but this feature seems like the most grotesque breach in online privacy/security.

What are ways to avoid this except for using obfuscated text?

  • AwkwardLookMonkeyPuppet@lemmy.world
    link
    fedilink
    English
    arrow-up
    21
    ·
    8 days ago

    This is a perfect example of why all of these privacy intrusion practices should be illegal. The same goes for services like Gmail. I use my own email server because I don’t want Google reading my messages. But it doesn’t matter, because everyone else uses Gmail, so any time I communicate with someone, Google reads my emails, despite the fact that I never agreed to their oppressive ToS. It’s a blatant violation of our right to privacy.

    • FriendBesto@lemmy.ml
      link
      fedilink
      arrow-up
      4
      ·
      edit-2
      7 days ago

      It is the same with Google Fonts. Everyone uses them, so your browser will have to ping Google Servers to get them. Even blocking them, puts you in a smaller bin of users since most people do not block them, which can help them profile you.

      I got lucky and forced everyone I keep mostly on touch away from Gmail and into either my Nextcloud instance chat and/or Signal, XMPP or Delta Chat. Which are on mobile.

      Another user mentioned PGP, great in theory, but most people I know do not use it and will not touch it. They think it is too complicated, which is not. But people are lazy if they do not care about privacy. I got lucky that I made most switch.

      • AwkwardLookMonkeyPuppet@lemmy.world
        link
        fedilink
        English
        arrow-up
        1
        ·
        7 days ago

        That’s a great point about the fonts. And Google Analytics, and AdSense, and their jQuery CDN. They have a whole lot of ways to inject their tracking into every site out there.

    • arsCynic@slrpnk.netOP
      link
      fedilink
      arrow-up
      6
      ·
      edit-2
      8 days ago

      But it doesn’t matter, because everyone else uses Gmail, so any time I communicate with someone, Google reads my emails, despite the fact that I never agreed to their oppressive ToS.

      That’s avoidable by PGP encrypting your emails though. But I’m sure you know that, and I’m sure you meant that getting most people to use PGP is a pipe dream.

      • curry@programming.dev
        link
        fedilink
        arrow-up
        4
        ·
        8 days ago

        Even if you got them using PGP somehow, there’s always a risk. Apps designed to upload screenshots, share contacts or simple human errors like “hey did you hear X saying Y”, etc.

        • arsCynic@slrpnk.netOP
          link
          fedilink
          arrow-up
          3
          ·
          8 days ago

          Yes, but Recall is spyware by design posing as a benign feature. This kind of unethical behaviour I vehemently oppose.

  • glimse@lemmy.world
    link
    fedilink
    arrow-up
    18
    ·
    8 days ago

    Turn off your computer, move to a cave in the mountains, and abandon society.

    A bit extreme but there is nothing you can do to stop your messages from appearing on Windows machines except not sending them to anyone who might view them on Windows machines…which will definitely be nearly impossible in 2024

    • CHKMRK@programming.dev
      link
      fedilink
      English
      arrow-up
      6
      ·
      8 days ago

      Works great until some hikers take a photo with you in the background, that gets backed up to iCloud, then they want to show the photo to a friend, download it to their computer, open it and BOOM, Microsoft AI knows your face

  • MalReynolds@slrpnk.net
    link
    fedilink
    English
    arrow-up
    10
    ·
    edit-2
    8 days ago

    Wow, valid issue.

    Spitballing, potentially a secure app could run memory only, blah, blah, blah. Nope, you’ve given M$ your screen FFS, it’s all over. If you care, move elsewhere, tell your friends…

    As you point out, codes are an option, but it’s not a slippery slope, it’s a waterslide.

  • reddig33@lemmy.world
    link
    fedilink
    arrow-up
    9
    ·
    8 days ago

    So is there a way for businesses to disable this garbage feature through managed device settings or something? I’m guessing corporate legal departments aren’t going to be too thrilled with this feature.

  • GetOffMyLan@programming.dev
    link
    fedilink
    arrow-up
    7
    ·
    8 days ago

    It can be turned off so it’s up to the person you’re messaging. Once you send something the person at the other end is in control of what happens to it.

    • arsCynic@slrpnk.netOP
      link
      fedilink
      English
      arrow-up
      6
      ·
      8 days ago

      Once you send something the person at the other end is in control of what happens to it.

      True, but this is the beauty of trust. I decide to communicate one way or another with someone depending on the level of trust. Them deciding to break that trust is a risk I chose to take. However, I do not choose to communicate with Microsoft, whatsoever. Windows Recall is the most blatant piece of spyware ever; beyond comprehension how this is so normalized.

      • BananaTrifleViolin@lemmy.world
        link
        fedilink
        English
        arrow-up
        4
        ·
        8 days ago

        Then you have to trust the person you are communicating with has turned off windows recall. That has to be the starting position.

        Tools will come to block or break windows recall but it will still be based on trust that the recipient is using them. Privacy centred apps like Signal wouldn’t want windows screen shotitng every message for example. There are many apps and tools including in the professional sphere that would not want their data leaking via recall so it will come.

        Unfortunately it may come late in the professional realm probably after scandals break. Employers using recall data to investigate staff for example - it’s bound to happen eventually.

        My own organisation, a huge health organisation, has opted in to CoPilot. It’s crazy in my view, even if our data is ring fenced in some way. I don’t want private patient information being used to train Microsoft shitty tools, or stored on their servers. Regulation and the law is way behind when it comes to this stuff.

  • communism@lemmy.ml
    link
    fedilink
    arrow-up
    6
    ·
    8 days ago

    If there’s anything sensitive I’m communicating with someone digitally, I make sure that the person in question has basic tech security skills and knowledge about privacy, including telling them to stop using Windows. Including taking the time to teach them basic stuff (like full disk encryption, VPN and Tor usage, explaining E2EE, etc) myself. If you have a high threat model but are talking to non-techy people, you should be taking the time out of your day to do this.

    If you’re thinking “wow I can’t be bothered to do all that”, your messaging is probably not sensitive enough for this to be a significant concern. Not that “if you have nothing to hide you have nothing to fear”, but just “the amount of time you put into security and privacy should be proportionate to your threat model and the cost of compromise”.

  • Autonomous User@lemmy.world
    link
    fedilink
    English
    arrow-up
    1
    ·
    edit-2
    8 days ago

    You must start spreading libre software effectively. You don’t control their device. You mist show them how to fix it.

      • Autonomous User@lemmy.world
        link
        fedilink
        English
        arrow-up
        1
        ·
        edit-2
        7 days ago

        I would focus on those directly around you first (not online strangers) and showing them by example to do the same, like my last post. Rather than telling them, find ways to make them want to ask you themselves. Make them start the conversation.

    • arsCynic@slrpnk.netOP
      link
      fedilink
      English
      arrow-up
      4
      ·
      edit-2
      8 days ago

      I’m afraid this comment shows a severe underestimation of the gravity of the issue. Windows recall doesn’t stop at borders even if it were illegal there.

      • Boomkop3@reddthat.com
        link
        fedilink
        arrow-up
        1
        arrow-down
        5
        ·
        8 days ago

        Well, it’s not here yet. And I do use windows 11, as does my mom, my grandparents and other pc’s I’m the one helping with. I don’t recall any recalls :p

        And if they do push it here, it’s probably followed by a news headline “eu fined Microsoft 10 billion for gdpr violation” or something like that