[HN Gopher] Tested: Microsoft Recall can still capture credit ca...
       ___________________________________________________________________
        
       Tested: Microsoft Recall can still capture credit cards and
       passwords
        
       Author : rntn
       Score  : 44 points
       Date   : 2025-08-01 19:49 UTC (3 hours ago)
        
 (HTM) web link (www.theregister.com)
 (TXT) w3m dump (www.theregister.com)
        
       | Bender wrote:
       | I still can not comprehend why Recall is not considered spyware,
       | especially by people here on HN of all places. I would expect
       | that by now there would be popular tools to real time stream-
       | convert all data written to be RickRolls.
        
         | dmitrygr wrote:
         | Who said it was not considered such? It is spyware.
        
           | Bender wrote:
           | I've been gas-lit in the past here by people claiming its a
           | great addition and can be ingested by AI _and all the
           | wonderful things they can do with it_. I do not my data in
           | anyone 's AI. Not local. Not remote. Not for any reason.
        
             | dmitrygr wrote:
             | Something can both have high utility and be evil. For
             | example 24/7 surveillance and universal shock collars would
             | have great utility in ending crime. But would also be evil.
        
               | Bender wrote:
               | Indeed. I do not want any surveillance shock collars on
               | my system. It should be trivial to remove it and have
               | confidence it will never show up again.
               | 
               | I have installed many surveillance systems but the
               | difference is I fully control them and I know that they
               | can not upload data without going out of my way to make
               | that happen. _Local DMZ on separate physical network,
               | Chroot SFTP-Only server, no internet routing, no DNS,
               | etc... push-pull_
        
         | ranger_danger wrote:
         | I have not seen any evidence that it actually ever sends any
         | captured data over the internet... wouldn't that be a
         | prerequisite for most definitions of 'spyware'?
         | 
         | There's also OpenRecall if you prefer a FOSS solution.
        
           | Bender wrote:
           | If it is stored locally that is the same as stored remotely
           | as far as I am concerned. I have decades of experience with
           | Microsoft to know better than to trust their pinky-promises.
           | I do not need to wait and see evidence each time Microsoft
           | does something shady. It might take a decade or more for the
           | truth to leak out.
           | 
           | If some form of AI is running locally it can extract
           | summarized information and upload it in a tiny file much like
           | Discord can silently transcribe voice to obfuscated and
           | compressed text in the background for private chats.
           | 
           | Anything that even smells like Recall must be opt in and give
           | people good incentives to _install_ it even before
           | considering the possibility of anything being uploaded. If
           | there isn 't anything shady occurring then I should be able
           | to click "Uninstall" in apps and it removes all the code. If
           | I can't single click remove it there is a reason.
           | 
           | Regarding FOSS, whether a tool is open or closed source does
           | not expose the dark patterns that can be implemented by the
           | operator which in this case is not the owner of the laptop or
           | workstation. I can do nefarious things with open source
           | tools, as can Microsoft. They are the administrators of this
           | service running on peoples machines. I can use powershell to
           | upload files from a persons machine, as can Microsoft. Every
           | operating system have all the tools a spy would need built in
           | to gather, obfuscate and upload data silently in the
           | background.
        
       | VohuMana wrote:
       | I'm not up to date with how the filter is supposed to work, the
       | article mentions it hides Google Password Manager but didn't hide
       | passwords in plain text in a notepad text file. Seems like maybe
       | programs have to indicate they should be hidden from Recall?
       | 
       | That said the feature still seems kinda dumb to me and feels very
       | much like a solution in search of a problem. There is a ton of
       | data on a device which doesn't require screen shotting
       | everything. Want to help the user find some website they visited
       | long ago? Just parse every web page the user visits and summarize
       | it no screen shot necessary
        
       ___________________________________________________________________
       (page generated 2025-08-01 23:01 UTC)