News Total Recall: the only Copilot+ AI feature that matters is a huge privacy risk

[USAFRet]

Reminds me of an episode of Black Mirror called "The entire history of you".

Google already knows this.

 

[sitehostplus]

I'm actually glad I can't run this crap.

With as many financial websites as I visit, I don't need someone stealing my passwords to those.

 

[The Hardcard]

why is everyone complaining? You are about to get new computers. Paid for by your wives and or your bosses. Both will love this feature.

 

[edzieba]

I've heard that multiple times.

Testing this, I do not see it.

A Win 10 VM VirtualBox guest, in a Win 11 Pro host.
Wireshark running on the Win 11, monitoring traffic.

Doing whatever on the Win 10, I do NOT, repeat do NOT, see "keystroke" traffic from the Win 10 system moving outwards.


Do you have any other evidence of this?

Shush you, you're not supposed to hold conspiracy theories to any sort of evidentiary standard, much less actually test them!

 

[apiltch]

Reminds me of an episode of Black Mirror called "The entire history of you".

I thought the same exact thing! Rewind, which is available for Mac and was supposed to come out for Windows at some point, is even more like the episode because it captures and interprets audio. Better still, the company that makes Rewind, Limitless, is coming out with an audio-recording pendant that captures all of your conversations all day long!

 

[Silas Sanchez]

Shush you, you're not supposed to hold conspiracy theories to any sort of evidentiary standard, much less actually test them!

This is just rhetoric and prejudice. You haven't achieved anything besides coming off as ignorant. For one thing you are assuming it's a conspiracy theory in an uncritical way. Please tell us what "evidentiary standard" means? Perhaps its because many hold your mentality that the world is full of nasty scandals and unconstitutional people taking away our rights. The really interesting part is it's people who are ignorant that are the real victims and they are apparently not even aware.
No actually there are many CT that should be tested, on the grounds that they can be quite plausible with sizable motive and reasons to support them.
You also seem to not understand that your using the word test in an equivocating way, there are multiply definitions. Some things by their nature are very hard to test due to the large money needed, the fact that the government can easily cover up stuff and dictate what can and cant be tested. Failure to test certain theories does not imply they have been falsified. We are told there is nothing wrong with tap water, that the science says its safe. But that is just another way of saying the science is as scant as hell.

It's only a matter of time until you literally can't use your PC without a live internet connection, its only a matter of time until a live webcam is mandatory. The crucial key here is slow gradual changes, this, as the dogmatists have long been aware of, is a perfect unfailable mechanism for weeding out criticism, it works everytime. This is what happens when you give people power, they strip you of your rights.

 

[USAFRet]

its only a matter of time until a live webcam is mandatory.

That won't fly in MANY offices and workspaces around the world.

At the beginning of Win 10, and the years since, I had heard many people spouting that it records every keystroke and file, and sends them to the mothership in real time.
So I decided to test. And saw NO evidence of this.

About the closest it gets is to sync with OneDrive. Which is (currently) optional.

 

[edzieba]

For one thing you are assuming it's a conspiracy theory in an uncritical way. Please tell us what "evidentiary standard" means?

Simple:
- A claim is made that Microsoft is logging all keypresses and sending them back over a network connection
- Evidence for this would be trivial to gather: logging network traffic from a machine running windows and capturing the packets containing that keylogging data. Tools like BSI's Telemetry Monitoring Framework can also inspect the data that is gathered even in isolation without a network connection.

The problem for the claim is that not only does no such evidence exist, all evidence (i.e. everyone who has captured and snipped Windows network traffic to see what's in the telemetry) has shown that such data is not being returned.

When claims are being made not only in the absence of evidence but contrary to evidence, that is a classic conspiracy theory.

 

[slightnitpick]

I thought the same exact thing! Rewind, which is available for Mac and was supposed to come out for Windows at some point, is even more like the episode because it captures and interprets audio. Better still, the company that makes Rewind, Limitless, is coming out with an audio-recording pendant that captures all of your conversations all day long!

This is really problematic for all-party consent states such as California. They'll be exposing their customers to legal liability unless the pendant is able to filter out voices other than that of the owner.

 

[slightnitpick]

Simple:
- A claim is made that Microsoft is logging all keypresses and sending them back over a network connection
- Evidence for this would be trivial to gather: logging network traffic from a machine running windows and capturing the packets containing that keylogging data. Tools like BSI's Telemetry Monitoring Framework can also inspect the data that is gathered even in isolation without a network connection.

I have no horse in this race, but just want to state that this is not a trivial task if: Data is encrypted for transmission, and the data isn't sent back in real time, but instead batched for transmission.

Still, it should be possible to determine which IP addresses the data is being sent to, which will tell you something. However to get around this they could conceivably sync it up with Windows Update checks. Though I suspect if Microsoft was doing anything like that they'd have a Snowden moment and also open themselves up to a huge amount of government liability (with criminal prosecutions and break up of the company). As there's no way in hell the US government, much less foreign governments, would be okay with Microsoft snooping on classified government work.

So it could be done, and done in a manner which is not trivial to check, but it's not plausible that it is being done.

 

[edzieba]

I have no horse in this race, but just want to state that this is not a trivial task if: Data is encrypted for transmission, and the data isn't sent back in real time, but instead batched for transmission.

Except the encryption needs to happen on the local device, so is subject to certificate injection (same way employers can decrypt packets from managed devices regardless of SSL/TLS/HTTPS).

 

[35below0]

Few care but most don't. They

This is what happens when you give people power, they strip you of your rights.

Like train conducters? Or mayors? Superintendants?

There is no logic in what you are saying. Power should be under control. And it is the biggest problem of our time. But just giving up and burying your head in the sand does nothing but encourage abuses. You're just shouting.

It's only a matter of time until you literally can't use your PC without a live internet connection, its only a matter of time until a live webcam is mandatory. The crucial key here is slow gradual changes, this, as the dogmatists have long been aware of, is a perfect unfailable mechanism for weeding out criticism, it works everytime.

Why would i not want an internet connection?
Also, i do have a PC that runs offline. And it will be possible to run computers offline or side-step problems cause by being always on-line.
A live webcam is mandatory for what? Signing in? Don't be absurd. Cams can break down.

There is nothing but criticism. Heaps of it. Tom's Hardware cannot compare two GPUs without people biting about how there should be three, or the price of one is wrong. And the colors of the graphs are total puke.

 

[slightnitpick]

Except the encryption needs to happen on the local device, so is subject to certificate injection (same way employers can decrypt packets from managed devices regardless of SSL/TLS/HTTPS).

Can't it be encrypted by a subroutine and key in the kernel that cannot be altered without bricking the OS (except the very first time the OS is installed with its license key in order to generate the unique key for that installation)?

Assuming malfeasance on the part of Microsoft, the point in this encryption wouldn't be point-to-point security, but total security of the generated code until decrypted. As the hypothetical malevolent Microsoft wouldn't want the user to know what's going on either.

 

[edzieba]

Can't it be encrypted by a subroutine and key in the kernel that cannot be altered without bricking the OS (except the very first time the OS is installed with its license key in order to generate the unique key for that installation)?

No dice: the OS would need to verify that key against something, and you also have control over whatever something the key is being verified against.
Same fundamental problem as DRM: if you hand the end user the key, the end user has the key.

 

[slightnitpick]

No dice: the OS would need to verify that key against something, and you also have control over whatever something the key is being verified against.

You don't have control over which license keys actually unlock the OS for use. Microsoft has control of that.

PGP: The end user has an encryption key but doesn't have the decryption key. And good luck generating a new key if there is no known public key to generate it with.

 

[Task Force 141]

Yeah, this garbage will certainly make people more willing to adopt Win 11.
Does Satya Nadella even look at himself in the mirror anymore?
It's become a race to see who is more evil, Google or MS.

 

[edzieba]

You don't have control over which license keys actually unlock the OS for use. Microsoft has control of that.

PGP: The end user has an encryption key but doesn't have the decryption key. And good luck generating a new key if there is no known public key to generate it with.

Windows activation keys are not encryption keys. The 'key' is more like a very short signed certificate: a key can be tested for validity, but is not used to encrypt or decrypt any content (either locally or remotely). This is why you can - for example - host a KMS to pass license keys to Windows without ever contacting Microsoft's servers.

 

[slightnitpick]

Windows activation keys are not encryption keys. The 'key' is more like a very short signed certificate: a key can be tested for validity, but is not used to encrypt or decrypt any content (either locally or remotely). This is why you can - for example - host a KMS to pass license keys to Windows without ever contacting Microsoft's servers.

No kidding. The key would serve as the unique seed during part of the generation of the OS-level encryption key. MS would have no problem decrypting it as it would be able to access this activation key as long as your computer is attached to the internet.

From my other comment that you responded to immediately before this response in out conversation:

except the very first time the OS is installed with its license key in order to generate the unique key for that installation

I'm just arguing here that one doesn't need to use an encryption protocol that can be man-in-the-middled if one (MS) has initial control over both the operating system of the origination system and the destination system.
So I guess technically MS wouldn't even need to use something like the license key in order to generate a unique encryption key. It could instead just use the same key for everyone and use other device-level unique identifiers (TPM?) in order to uniquely identify which computer the data is coming from.

 

[apiltch]

This is really problematic for all-party consent states such as California. They'll be exposing their customers to legal liability unless the pendant is able to filter out voices other than that of the owner

Their answer to this is that there's a "consent mode" where you have to ask anyone you are speaking with for their consent and then it will only transcribe their words if they say "yes." This is demoed at about 4:30 in this video.

View: https://www.youtube.com/watch?v=G2zW4-J4ib0


I can't wait for this to come out so I can test to see how well the consent feature actually works. That would be the absolute first thing I'd try with it and, if it fails at all, the product has a huge problem.

 

[slightnitpick]

I can't wait for this to come out so I can test to see how well the consent feature actually works. That would be the absolute first thing I'd try with it and, if it fails at all, the product has a huge problem.

Thanks a bunch. When you test it can you try to find people with very similar voices (both pendant wearer and non-wearer, as well as two non-wearers in a three person discussion)? Theoretically the device could distinguish between people based on directional sound, and it would be interesting whether it does.

 

[DavidC1]

Though I suspect if Microsoft was doing anything like that they'd have a Snowden moment

Here's the thing. Vast majority aren't aware he exists nevermind what he talks of. And the leftover doesn't care.

And the US government has been busy chasing both Snowden and Julian Assange. There will be no justice for them, because just like one comic says if you accuse your government of committing crimes, you'd be prosecuted for it.

This is why companies like Microsoft can do this. And unless there's a titanic uproar(not virtual ones like on TH) nothing will change and they will continue to up the ante.

 

[slightnitpick]

Here's the thing. Vast majority aren't aware he exists nevermind what he talks of. And the leftover doesn't care.

And the US government has been busy chasing both Snowden and Julian Assange. There will be no justice for them, because just like one comic says if you accuse your government of committing crimes, you'd be prosecuted for it.

This is why companies like Microsoft can do this. And unless there's a titanic uproar(not virtual ones like on TH) nothing will change and they will continue to up the ante.

Snowden and Assange were leaking information *about* the US government. A whistleblower *telling* the US government that MS is spying on them would have a hell of a different response, especially given MS's recent large-scale breaches.

 

[DavidC1]

Snowden and Assange were leaking information *about* the US government. A whistleblower *telling* the US government that MS is spying on them would have a hell of a different response, especially given MS's recent large-scale breaches.

So what?

Doing wrong is justified because it's "guvernment"? Bad is bad. They are headed towards corruption and authoritarianism not seen since Nazi Germany days.

 

[slightnitpick]

So what?

Doing wrong is justified because it's "guvernment"? Bad is bad. They are headed towards corruption and authoritarianism not seen since Nazi Germany days.

whoosh

 

[dclark064]

Is this "on" by default or does the user need to turn it on? If it is on can the user turn it off?
My understanding is the user has to turn it on. Is that correct? If not turned on is there still a security risk?