If one chats/mails with a person using Windows, despite using secure private protocols, every message will be stored by Microsoft’s Windoze Recall. Either I’m missing something but this feature seems like the most grotesque breach in online privacy/security.
What are ways to avoid this except for using obfuscated text?
You must log in or register to comment.
If it leaves your device, you cannot control it.
Right but you could at least be reasonably sure it wouldn’t be outright spied on from the person you’re sending it to. Now it’s almost a guarantee.
Like if I sent something to a friend of mine, I could be fairly certain it wouldn’t end up in the wrong hands unless they got compromised or did something stupid. I could trust their competence.
Now everyone that isn’t actively managing their own windows installation is absolutely compromised, as a rule. Like I can’t just send an email to my mom anymore, from now on its always my Mom and Copilot.
deleted by creator
It is the same with Google Fonts. Everyone uses them, so your browser will have to ping Google Servers to get them. Even blocking them, puts you in a smaller bin of users since most people do not block them, which can help them profile you.
I got lucky and forced everyone I keep mostly on touch away from Gmail and into either my Nextcloud instance chat and/or Signal, XMPP or Delta Chat. Which are on mobile.
Another user mentioned PGP, great in theory, but most people I know do not use it and will not touch it. They think it is too complicated, which is not. But people are lazy if they do not care about privacy. I got lucky that I made most switch.
deleted by creator
But it doesn’t matter, because everyone else uses Gmail, so any time I communicate with someone, Google reads my emails, despite the fact that I never agreed to their oppressive ToS.
That’s avoidable by PGP encrypting your emails though. But I’m sure you know that, and I’m sure you meant that getting most people to use PGP is a pipe dream.
Even if you got them using PGP somehow, there’s always a risk. Apps designed to upload screenshots, share contacts or simple human errors like “hey did you hear X saying Y”, etc.
Yes, but Recall is spyware by design posing as a benign feature. This kind of unethical behaviour I vehemently oppose.
Can’t control what other people do so you might be out of luck.
It’s more about what Microsoft enforces—spyware—than what other people do.
I meant you can’t stop then from using Recall.
The best way is to use comms channels that avoid their Windows install entirely. If Recall never sees it, it never gets recorded.
Turn off your computer, move to a cave in the mountains, and abandon society.
A bit extreme but there is nothing you can do to stop your messages from appearing on Windows machines except not sending them to anyone who might view them on Windows machines…which will definitely be nearly impossible in 2024
Works great until some hikers take a photo with you in the background, that gets backed up to iCloud, then they want to show the photo to a friend, download it to their computer, open it and BOOM, Microsoft AI knows your face
I couldn’t wait to post this obligatory fragment of Parks and Recreation - Ron vs. Online Privacy: https://youtu.be/8xn1rO1oQmk
If there’s anything sensitive I’m communicating with someone digitally, I make sure that the person in question has basic tech security skills and knowledge about privacy, including telling them to stop using Windows. Including taking the time to teach them basic stuff (like full disk encryption, VPN and Tor usage, explaining E2EE, etc) myself. If you have a high threat model but are talking to non-techy people, you should be taking the time out of your day to do this.
If you’re thinking “wow I can’t be bothered to do all that”, your messaging is probably not sensitive enough for this to be a significant concern. Not that “if you have nothing to hide you have nothing to fear”, but just “the amount of time you put into security and privacy should be proportionate to your threat model and the cost of compromise”.
Ugh, I didnt think about that😬
Either use secure, encrypted VoIP calls (e.g. over Signal or another secure messenger with an end-to-end encrypted call feature)
Or you use a secure messenger that only runs on smartphones and doesn’t have a desktop client
deleted by creator
Absolutely
Don’t forget that while they managed the PR better, apple “Intelligence” also has access to damn near everything on your devices.
Yet there’s no backlash because they’re not so stupid as to say “we’re gonna take screenshots as you go so we can improve your digital life kthxbye”.
You must start spreading libre software effectively. You don’t control their device. You must show them how to fix it.
Last year I did so by writing the essay “What if I paid for all my free software?” It came across well. Now I’m thinking of ways to reach a broader audience in order to not only be preaching to the choir.
I would focus on those directly around you first (not online strangers) and showing them by example to do the same, like my last post. Rather than telling them, find ways to make them want to ask you themselves. Make them start the conversation.
Rest assured, I do that too ;)
It can be turned off so it’s up to the person you’re messaging. Once you send something the person at the other end is in control of what happens to it.
Once you send something the person at the other end is in control of what happens to it.
True, but this is the beauty of trust. I decide to communicate one way or another with someone depending on the level of trust. Them deciding to break that trust is a risk I chose to take. However, I do not choose to communicate with Microsoft, whatsoever. Windows Recall is the most blatant piece of spyware ever; beyond comprehension how this is so normalized.
To my knowledge, there isn’t. But you can ask the person to turn off recall. I’m going to be running 11 in a VM myself so /me shrugs
The code for Recall is in the code for File Manger. Recall cannot be turned off if you want Windows to load and function.
Is this not accurate (anymore)? https://www.windowscentral.com/software-apps/windows-11/how-to-disable-windows-recall#section-how-to-uninstall-windows-recall
That’s just the off button. But you can’t remove it because they tied it to explorer as a dependency. Off or not, explorer doesn’t work with out recall.
Turning it off is a good step 1, but what’s stopping some malicious software, such as every windows update, from turning it back on and selling our data for profit.
