Microsoft addresses Windows Recall backlash, promises to fix security issues and make it opt-in

pound_heap@lemm.ee to Technology@lemmy.world – 463 points –
Microsoft addresses Windows Recall backlash, promises to fix security issues and make it opt-in
windowscentral.com
126

We have seen this game 100 times. Opt in for now and then turned on for everyone 6-12 months later. It's just a temporary move to handle the bad PR.

You forgot the best part

Silently turned on via "security" update

Or the other trick of constantly prompting "Turn on / Maybe Later" until people either accidentally accept or just give up to make nagging stop.

That guy at the club who won’t fuck off

registry switch that'll mysteriously reset itself. we've had this shit with countless windows configurations at work that our IT guy has to battle with on the regular.

I've had so many people jump down my throat for listing some of the many obviously fucked things Microsoft did on my PC just over the life of Windows 10. (And not that it should matter, but I even paid for Pro).

I turned all their various advertising and spying "features" off through legitimate settings, group policies, whatever, and the list of things that reverted themselves over time was insane.

User: Goes through 15 step process to turn off unwanted "feature".

Windows: I turned this on, in case it got turned off accidentally. I'll do this every reboot.

And not that it should matter, but I even paid for Pro

It should matter though. If MS wants to give away Windows for free, then users should expect compromised privacy. But it's not. They charge hundreds for it.

If Windows made a paid version that was private and secure, and that the user was in control of, I would buy it in a heartbeat.

If they were giving away Windows for free, their behavior would still be unforgivable.

There is no scenario where any operating system including spyware or ads can ever theoretically be acceptable behavior. Any person who contributes in any way to that happening belongs in a prison cell.

Well that's the only way a "free" product is sustainable.

Linux is free qnd plenty sustainable.

If you can't support providing something for free via a mechanism that isn't pure and unadulterated evil, then don't do it for free. "We have to be monsters to make money" is not a valid position.

Linux is free qnd plenty sustainable.

It also has a vast array of enormous compromises, which is why no one uses it.

I understand you have qualms with Linux, and that's plenty fine, but when the large majority of servers and smartphones around the world run it, you can't say that no one uses it.

That's not true at all. It has a huge market share, just not in desktops.

But again, that's completely and utterly irrelevant. If being evil is the only way for your business/product to exist, it does not deserve to exist.

Yeah dude, there's nothing they can do to fix this. They have eroded the trust of their users for decades. It will take them decades to get it back, if they actually tried.

Also it took hackers days to find vulnerabilities. Which is a massive security concern.

Can anyone give me examples of times Windows has done this in the past? I mean, I feel like this is true, but I legit can't think of anything that matches this.

In the last 6 months:

  • One Drive reinstalled and turned back on on my personal & work computer multiple times.
  • AI Co-pilot added to my machine and enabled "so you can start using it now!" with an obtrusive pinned shortcut on my start bar, to both of the same machines but at different time intervals. Uninstalling is virtually impossible and requires registry mods to 'remove" it. Not even a powers he'll command can remove it.

I don't want, or need, this add-on garbage.

Perfect examples, thank you 👌

Opt-in does not matter, if I message or email someone who has it on, my personal data has been collected without my knowledge or consent.

This shouldnt have been built in the first place, it's irresponsible

This raises an excellent point not considered. This goes for all texts as well if the other person uses the "your phone" app. Discord, matrix, signal, telegram etc are all compromised by this existing on a system.

Will my browser's "private mode" be respected or it is going to store every inappropriate thing I search?

Are password managers safe? How about bank security questions? How often are those actaully obfuscated. The last 4 digits of social security numbers are usually unobfuscated, which is also what a lot of intuitions (stupidly) use to verify your ID over the phone. What if I want to look at the PDF of my tax documents?

What if my HR manager has this enabled and starts viewing PDFs containing private information about employees, payroll data, finances and whatever else is sellable on the dark web.

How about govermnet data? Sure maybe the pentagon IT staff will completely block it, but what about local gov committee ABC that's collecting voter information?

That type of data is valuable enough that it will be targeted regardless of what protection MS attempts. Based on the fact they didnt bother encytping the data from the start, my faith is low.

The implications of this are insane.

That's true of any malware on your contact's computer or an unsecure server, though. That is not specific or novel to this feature.

(I'm not saying I like this feature, or think it's a good idea. I don't, and it's not)

So what you are saying is, is that it's malware. I agree.

I maintain one baremetal Windows install that gets fairly regular use. It's on a major OEM business class workstation with a legit Windows 10 pro license.

Recently, I had to wipe and reset and goddamn do they try and trick you into choosing all the worst spyware settings AND even if you successfully duck and weave past them, they'll just cheat and enable them, or reinstall shit like co-pilot during an update.

They just made me sign into that shitty M365 app to install a legit subscription of Office, and on the next reboot, it converted the local user account into an online user account.

Make no mistake, Recall is going to be enabled by hook, or by crook, for the vast majority of Windows 11 users in due time. No matter how many times they disable it, or opt out.

Yup. We’re back to the old days where Microsoft didn’t give a damn and enabled things by default.

It’ll take less than a decade before they get sued, yet again. By then, the penalty will be <5% of what they’ve made, but the merry go round will circle back and start all over.

Too late Microsoft, I jumped into the Linux pool and the water is fine.

Exactly. Running fedora desktop and I am thinking why the move does.not do more poeple. The only Microsoft junk I am using is the corporation laptop and that I am sure wont get this function.

How about you promise to remove your build in spyware?

opt-in until next update when it will be enabled "magically"

Let me tell exactly what will happen.

  • Step 1 - It's opt-in. Everyone chill
  • Step 2 - It's opt-in but the opt-in button is advertised during startup
  • Step 3 - "opting in in crucial for your safety and comfort" advertised everytime during startup
  • Step 4 - it's opt-out now but it can be turned off in settings
  • Step 5 - it's opt-out but the off button is hidden below 3 layers
  • Step 6 - the opt-out button is gone but can be turned off with a registry edit
  • Step 7 - sorry, it's a core component of W11

We are currently at Step 1

This comment is taken from another lemmy post but I forgot the username. Apologies.

If you don't opt in you will miss essential security updates and you will become a terrorist

I mean even if it is not mandatory but automatically enabled once, odds are %80 of the users won't even bother turning it off so win for windows in any case

As a reminder this was the go-to play for Facebook when they were caught with their hands in the cookie jar. Default it off until nobody's looking and change it slightly so it was named 'differently' and on it went again.

I don't even care if it's opt-in. I don't want dormant malware on my PC either.

To be clear. I actually like Windows 11. I don't care about the general telemetry, though I disabled the typing data crap. Most of the things in the last few months about ads in Windows, about blocking apps, etc have been overblown and aren't actually big problems in isolation. Even this is a little overblown right now as it requires an NPU which the vast majority of systems don't have. But, this is just so tone-deaf and an obviously terrible idea that it needs to be put down hard.

Yeah, they're so focused on screwing me over that I'm worried eventually I'll miss something.

Most of the things in the last few months about ads in Windows, about blocking apps, etc have been overblown and aren't actually big problems in isolation.

Any telemetry sent without a very clearly informed opt in is malicious. Any ad in an OS is malicious. There is no valid justification for either.

I don't want *dormant* malware on my PC either.

"Why not?"

--Micro$oft, probably

as it requires an NPU which the vast majority of systems don't have

Don't have at the time. I agree with you but argument that it's not an issue for many people right now will bite the majority eventually

How do you "fix" the security issues of a program that is literally designed to spy on you?

I've just switched to Linux Mint and I'm not ever coming back. That's how I "fixed it."

They'll always play right on or just over the line to see when/how people push back. They knew what they were doing, they started at a 9 intentionally so that people push back to and live with a 7

MS really has always done this, what's the name for this kind of marketing maneuver? Manufactured consent? Manufactured begrudging tolerance?

Like politics, were adding 200% to this inconvenience!

Then rolling back to "only" 50% (the initial target).

I mean... Yeah? That's kind of the point isn't it? Test the waters and figure out just how far they can push it? Find the limit of acceptance and ride that?

Opt-in but you get an annoying full screen popup every boot, like for the windows11 upgrade. It's only a matter of time, til they sell AI recall features as Win12 and then beg you to upgrade for free, pretty please!

Or "(totally unrelated feature) is not available unless you activate AI recall. Click here to activate."

There is no way I'm going to use a machine where they can turn on something remotely through a update or some other fashion. I probably won't even have a 11 vm at home now. I'll keep the 10 vm for its minor uses until it can no longer do the few things I use it for but that is it for me. Remove that garbage or lose more of us macroshaft.

It boggles the mind this isn't an external download you have to specifically navigate to their website to download and install. The fact it is soon to be on Win 11 systems, just a toggle away, is terrifying. Particularly since lots of people handle your personal data, while data collectors like this are on their machines (and many of those machines will have the collector turned on).

I wish, now have a i9-14900KF, so guessing no more Windows 10 anymore. Planning to make a Linux partition, but frustrating the way that Windows tries so adamantly to take boot priority.

Is Windows 10 unsupported by the newest processors?

I looked it up shortly after posting, surprisingly seems like Windows 10 is supported, but 11 did better in a few of the tests.

I'd recommend separate physical disks if possible. Set your boot order via uefi

Thanks. I’ve personally never altered boot order before, but it can’t be too complicated, right?

It's not very intuitive but it isn't so bad once you're familiar; you can take a look at this whenever's convenient for you.

When you boot the system, you should briefly see your BIOS splash screen, along with the key combo to get into your BIOS setup menu. Let us know which mainboard vendor you have and we may be able to tell you in advance (For Asus, it's usually F2, for Gigabyte its the Delete key, for MSI it might be F12 etc). I just mash the specified key when prompted until I'm in.

There's usually also a key that you can hit to select a temporary boot device (I.e. I can hit F12 on my gigabyte board to select any OS detected by the BIOS, not just boot into the top entry).

Once you're in, have a look for the 'Boot' section. You should have the capability to define your boot order. These entries can consist of traditional disks connected via SATA/SCSI/m.2, USB drives, network locations etc.

You can arrange this boot order however you like.

I would also recommended temporarily disconnecting any existing drives when installing an OS on your system (e.g.: Windows attempts to store its bootloader on SATA 0 by default, even if the OS isn't destined for that drive).

It feels like these huge ass companies are just testing people's reactions before they do something these days.

Windows 10 will be the last windows I will use. Already switching to Linux at least part time to wean myself off of Microsoft

"Make it opt-in" (for 6 months) At this point, Microsoft is the biggest advisement for Linux desktop

My 10 year prediction - Microsoft does a full transition to a services company:

  • Basic Windows is free, even for OEMs
  • Windows Professional becomes a subscription thing, maybe you get it as part of your Azure AD sub
  • Things like Recall or not having ads are extra subscriptions

There were already rumors halfway between 10 and the release of 11 that they wanted to do it that way, making 10 the last "standalone" release version

Windows 10 will be the last I work on. I work in tech and won't accept 11 as a work environment either.

Pretty sure they already said it would be opt-in. This is just planned damage control. The fools have already shown their hand. Again.

I heard it was opt-out originally, but I haven't looked into it tbh

I feel like not wanting to do the work for certain Steam games is what keeps me on windows for my personal use (work makes the decision on my work machine).

I know it’s possible, I just don’t want to do the work

No judgement for your choices, but just so you know, it's basically no work for the majority of games.

With the exception of any major games that have anti-cheat. I miss League of Legends.

Yeah, anti-cheat and the Ubisoft launcher have been the only consistent obstacles. protondb.com is a fantastic resource, though.

I'm not a fan of LoL, so I can't say from personal experience, but it looks like PlayOnLinux claims to support it. Hope you find your joy!

I wouldn't say "any" major games. Helldivers 2 is a notable exception.

I've played Helldivers 2 with no obstacles and no additional setup.

That's what I'm saying. It has anticheat, and it runs on Linux without issue.

Ah, I apologize. I definitely was not fully awake when I read your original comment.

No worries, I may have just been unclear considering multiple people appear to have downvoted my comment.

How is it for racing sims ? Last time I checked it didn’t look too good in terms of wheel drivers and games running ootb on Linux, or did I just not look in the right places?

Go to protondb.com and search for the games you're interested in. If your profile is public, I think you can import your entire library and browse through it instead of manually searching for each individual game. Ideally you want "platinum" compatibility but I've personally never had problems with "gold" games either.

I'm sorry, as much as I'd love to, I don't have an answer to this.

edit: corrected a word.

No worries, I had already given up on it for now I was just curious if someone could convince me to fully switch, or rather point me towards some open source projects I could use. Right now I boot into win11 for gaming and into fedora for everything else. Thanks anyway!

Good to know. I know wine can get steam going (assuming you don’t just use the Linux version). How do you get steam to download and install the game if it says it’s the wrong operating system? Sorry if that’s a dumb question

Your question isn't dumb. You just haven't been exposed to the environment. Please feel free to ask any question about this you have and, if I don't answer, someone else probably will.

If you install the Linux version of Steam, it should allow you to download any game. There's a checkbox in the Steam settings that says something like "run non compatible games through proton" (not what it says, but the general sentiment). Checking that and restarting Steam once is the extent of the setup required; after that, it's essentially the same process as running a game in Windows (with the few exceptions mentioned by another commenter). Non Steam games should be able to be run by Lutris, PlayOnLinux or adding a non Steam game to Steam, but I mostly haven't done that myself so I can't vouch for it. Sincerely, for most games, it's an easy process.

I'm no expert, but if you decide to pursue this and get stuck, please feel free to reach out to me and I'll do my best to help. The link below seems like a good starting point: https://geekflare.com/install-steam-on-linux/

Thanks, I appreciate the advice and kind attitude. I’ll check it out

Yeah I don’t know what to do with this. I’m about to start to start wfh and handle a lot of data that cannot be shared and comes with big fines for mishandling. I have to have office, mainly excel. Is Apple my only option? I know Linux exists, but I’m not a power user, I struggle with my printer.

I would recommend a VM to try a few things. HyperV, while not the greatest, is good to start off and comes with Windows Pro. Set up a Debian or Ubuntu and a Windows VM and take away its internet. That should get you most of the way.

Is your company not providing you a computer? It's up to them to manage that risk.

I am going wfh and I have to use their one drive to access client data. They will provide a computer, but versus my home setup it’s simply not worth it. I saw the idea about virtual windows and Linux machine. I’ve never done it but I imagine I can with some trial and error. But I’m wondering if even that is safe.

What do you mean it's not worth it? If you use the company's computer it's on them to handle all the liability. If you use your own computer then you're now on the hook. It is 100% worth it to use the company-provided computer.

Basically, they provide a decent Chromebook. It’s nearly impossible given the actual tasks. So I need to find a better way.

That's not on you. I would communicate with management and illustrate that you can't do your job without a proper computer. If they refuse to help, get it in writing. You should not be held accountable.

I've been researching wine and proton for Linux. Fuck windows! The only reason I still use it is for gaming but if wine works as advertised I'll be switching to Linux.

As someone who made the leap, I haven't booted Windows in months. Proton, Steam, and Lutris cover basically everything I play.

We're you already familiar with Linux or follow a guide? Lot of products I'm not familiar with there.

Proton is the compatibility layer to run Windows games on Steam. Lutris is an app that lets you run non-Steam games in a similar manner.

I didn't really follow a guide. I mostly started by dual booting Linux and seeing what worked.

Add Lutris to that list. If anything doesn't work in WINE, try installing via Lutris. My AxeFX's GUI now works flawlessly thanks to an older version of WINE running in Lutris.

"We won't turn it on and will never use it to spy on you" says government backed surveillance monopoly know for sneaking spyware into products and making it impossible to remove.

Oh.... Microsoft, Microsoft, Microsoft.

A friend of mine tried one of their "special offers" he nearly got himself lobotomized!

Ok, I'm gonna be perfectly honest, Microsoft recall, copilot, hello... I don't know what any of these things are. And I'm pretty sure I like it that way.

I do use Windows every day, (windows 10 and 7), but I haven't heard any reason to ever upgrade from these. All these "services" do not seem like a "value add" to me.

  • Recall is a proposed feature that would screenshot the Windows screen periodically, OCR the screenshots and store the results. Ostensibly supposed to be a "remember things you did" feature for the user but suspected to be a data collection tool for Microsoft to train its AI systems. Security researchers have also warned that it puts users at significant risk if their computers are breached by malware.
  • Copilot started as a programming AI tool which used open source software off the popular development site GitHub as training for its AI and as source of code samples. It's already caused Microsoft to be sued because it offers code verbatim to users without mentioning or obeying its licensing. Nowadays Microsoft is expanding the Copilot brand to include other kinds of AI assistance, for example one that helps you write emails in Outlook etc.
  • Hello is an authentication method for Microsoft accounts using biometrics and TPM chips.

What about the right to be forgotten? Where is that feature? Why isn't Microsoft making and marketing a version of Windows with something like "Windows Forget"?

I'll tell you why: no opportunity to double dip by collecting and selling your personal data.

It will now require Windows Hello (via facial recognition and/or fingerprint)

So Microsoft also wants my fingerprints and a realtime capture of my face? Yeah that totally addresses my concerns. /S

Def considering fedora for my surface 7. Microsoft & their shit is unacceptable.

Ive been using linux for like a year & a half !

Sweet! I was just being funny with my GIF, but I do honestly love the OS ecosystem, and think that everyone will like it more than Windows if only they'd give it the proper opportunity.

Im running a manjaro+openbox disto called MABOX linux on my chromebook. It’s fantastic for the low spec nonsense machine. But def considering fedora for the surface. Its come a long way apparently.

I'm actually having issues with fedora silverblue not updating. It's pretty frustrating, but a risk I knew going into immutable. I don't have time right now to figure out a fix. Regardless, I would totally do fedora again and recommend it to nonbeginners. It's an awesome variant, even coming into it from debian-based distros with only cursory knowledge of dnf.

I feel ya. I tried to revert back to kernel 6.7 from 6.9 and now my chromebook is being a turd.

Shame I stopped believing that BS from them circa winME…

Losing all your government contracts can be a great motivator.

I'm really hoping this shit is banned on all government and corporate computers. But, with how poor IT competence is.....such a ban will be sporadic at best.

This is the best summary I could come up with:


Today, Microsoft announced it is addressing a recent backlash around Windows Recall, its controversial forthcoming AI-powered search service that works by taking a snapshot of your PC every 5 seconds.

Recently, it was discovered that the feature stores data unencrypted on the device.

The company says it will ensure Windows Recall data is safe by employing "just-in-time" protection, which ensures the data is only decrypted when the user authenticates into the app with Windows Hello.

Additionally, Microsoft says it will make Windows Recall an opt-in experience, meaning it won't be enabled by default on Copilot+ PCs.

Microsoft also says it's making further security improvements to Windows Recall.

It will now require Windows Hello (via facial recognition and/or fingerprint) to be set up on the system and require the user to be present in front of the screen to access Recall data.


The original article contains 232 words, the summary contains 141 words. Saved 39%. I'm a bot and I'm open source!

Surely it's opt in anyway, seeing as you need some special wanky laptop with a magical AI bollocks chip for it to work.