this post was submitted on 01 Jun 2024
0 points (NaN% liked)
Technology
59672 readers
2965 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
You can define almost anything as a security risk. But we aren't children to play such stupid games.
We are talking about someone gaining that information and the probability of that happening without even knowing what security mesaures will be in place. I think the risk is negligible even today with the limited information about it that we have now. Other People here, presumably you as well are hysterical about it.
Thats what the discussion is. You actually believe Microsoft will launch this and then everybody will be hacked or something. I think that is... not smart.
No, I don't think "everyone will get hacked or something", don't put words in my. I mouth for the sake of your argument.
What it is, and this is undeniable, is a massive fucking privacy and security hole if someone gains control of your computer.
I didn't want to put words in your mouth, but wanted to clear up where each of us stand so there is no missunderstanding.
If somebody gains control of your computer today, that's a massive privacy and security hole in itself.
If you didn't want to put words in someone's mouth then you shouldn't have said something like
Oh a knight in shining armour trying to defend my dialogue partner?
Did you ask anyone needed defense? Because I'm pretty sure they don't.
If you read carefully I wrote "or something" at the end implying that I don't know exactly what they believe. It was not that subtle of invitation for them to agree with my first assessment or correct me. I will try to be really blunt in the future, so that you don't missunderstand again.
? I'm not defending anyone, I'm calling out bullshit when I see it
I don't really care that you like watching kids through their bedroom windows or whatever
If that doesn't accurately describe your views, no worries—I said "or whatever," so it's fine
What a dumb and petty response.
Bye.
Absolutely, but even with control of your computer, if you're smart, other accounts etc will still be inaccessible by the attacker.
Not when they get access to the Windows built in desktop spy saving everything it sees.
Not if it's encrypted and if sensitive information is not saved.
Main point is still that gaining control of someone's computer against their will is practically impossible today. If someone manages to do it, they already have your files and all the sensitive information they could want. They won't even bother with this recall. And if you are worried about it, you will be able to just turn it off.
Much ado about nothing.
"If sensitive information is not saved" is doing a lot of heavy lifting for you there. The issue is that it saves everything.
But it doesn't save completely everything. It does snapshots as far as I understand. So it's unlikely a whole password would be there on a snapshot. And again, it had to be mentioned that anything can be excluded from recall or disabled completely.
At this point it has to be again highlighted that gaining access to a computer is very hard and that in itself is game over scenario. More information can be gained from a keylogger than this recall feature.
A keylogger isn't retroactive to before the keylogger was installed though. Recall is. Also, with Recall you don't need to write keylogging software and get it past antimalware scans (and keep it from getting detected), you just have to get an infostealer past them one single time to take the Recall database.
It's very unlikely you could get the password from recall
????? It saves everything it sees that's the point ?????
Not the same as a snapshot.
The video posted by Moorshou literally shows someone getting a password and a credit card number from it. Yes, the password was due to someone clicking the show password button momentarily but do we just never expect people to use those or to not use a password manager that would show the password on screen at some point? Due to it doing text recognition, you would literally be able to just search for "credit card" to find all the times when it was displaying a credit card field on a checkout page or "password" to find all the times someone is logging in or using their password manager. And that's using the built in search, not even exfiltrating the data and processing it with more specialized tools.
You really need to watch that video to see what it can do and how easily it can do it.
So even if it does ship like this guy thinks it will, it will take someone gaining control of the computer and having the victim click show password at the wrong time.
The end is nigh.
https://github.com/xaitax/TotalRecall
User python script. Full control of computer not required.
And how does the python script run itself?
How does any virus run itself? Are you seriously this dense?
Hint: there are many attack vectors, including no-click drive-by downloads, programs from Softonic, etc.
Damn you are so stupid. But it's normal for stupid people to think they are smart.
Smarter guy here on lemmy calling other people names than all the people at Microsoft.
I'm done here. Bye.