For those who aren’t aware, Microsoft have decided to bake essentially an infostealer into base Windows OS and enable by default.
From the Microsoft FAQ: “Note that Recall does not perform content moderation. It will not hide information such as passwords or financial account numbers."
Info is stored locally - but rather than something like Redline stealing your local browser password vault, now they can just steal the last 3 months of everything you’ve typed and viewed in one database.
@Robertcw @NosirrahSec @GossiTheDog Oh they do. You should see how great Windows games can run on GNU/Linux systems thanks to projects like Proton. It's the runtime environment used by the Steam Deck.
Some games run even better with Proton than with a Windows system:
@TechnicalAdept @GossiTheDog I don't give a shit who knows about my sexual fantasies or my porn habits. (I am not saying that isn't a threat, but it isn't to me lol)
I just fear for those that ARE afraid of this threat, because to them it IS a threat.
@TechnicalAdept @NosirrahSec @GossiTheDog
Microsoft is doing in one OS update what once took visiting hundreds of porn sites over the course of a week once did to inject malware into your PC.
(Read a similar comment earlier today. The thought is not original.)
@NosirrahSec @TechnicalAdept @GossiTheDog Yeah, the abuse use cases are basically unbounded.
Sysadmin looks at password manager once, hacker has credentials to migrate from laptop to every device on the network. Politician looks at the "wrong" thing, high level blackmail. Woman looks at abuse shelters to leave her husband, becomeS homicide statistic. HR person looks at employee spreadsheet, hacker has PII for whole company.
You can't spend 5 seconds and not feel morally obligated to stop it.
@TechnicalAdept @NosirrahSec @GossiTheDog with generative AI "art" becoming more popular, soon the only refuge for true porn may become the one thing generative AI can't (yet) crack.
That's right. Bring back ASCII art porno, you cowards
Probably no revolt within Microsoft... after the massive downsizing, most of their people are either "toxic enablers, willing to support any awful shit 'to get ahead'".... or they're just phoning it in doing the 'internal retirement" thing while expecting to be let go in next reorg.
@GossiTheDog At no point in this video do they mention anyone asking for this. We didn't.
I love that they're leaning hard on the fact that the data is protected from other users. That... doesn't matter. You're running automated enumeration for anyone that gets access under my user context. Don't do that. Jesus.
@jgreig @GossiTheDog
@hacks4pancakes
Speaking from my compliance aspect, this comprehensively fails PCI and GDPR immediately and the SOC2 controls list ain't looking so good either.
@hacks4pancakes @jgreig @GossiTheDog
This situation has me absolutely livid - https://infosec.exchange/@munin/112480357946214139
Hey so, This windows recall thing? Enables domestic abuse.
@hacks4pancakes @jgreig @GossiTheDog
I want to know the name of the individual who shepherded this system for abuse into the OS, and I want to ask him some -very- fucking pointed questions about why he has chosen to create an unsafe, abusive environment.
@aud @hacks4pancakes @GossiTheDog @jgreig
having worked in an environment handling classified materials before, and having had to -clean up- from leakage of them,
@aud @hacks4pancakes @GossiTheDog @jgreig @munin
As Sr/T3 infrastructure and support at an MSP, let me tell you how misinformed clients are. (You know. I'm just saying rhetorically lol)
They will want this. They don't understand risk.
@aud @munin @hacks4pancakes @jgreig @GossiTheDog What shocks me is that MS would create a *discoverable record of activity on every one of their own PCs.
*: In the legal sense, i.e. subject to pretrial subpoena
@munin @jgreig @GossiTheDog @hacks4pancakes
Are we expecting a company like Microsoft, which is small and has no cybersecurity experience, to care about this?
@jgreig @GossiTheDog also, it won’t take screenshots of private browsing windows, but only if you use their browser. If you want the option to choose then it’s a big “fuck you”.
This is some of the most technological dystopian bs I’ve seen in some time
Hopefully these new security features will mean data generated on the device cannot be tempered with.
Markus👨🏻💻
Kevin Beaumont
Jon Greig
NosirrahSec 🏴☠️ guillotine enthusiast
Robert Wilson
Skyper 💻🎧☕📖
Jule
Matt Hardy 3.11 for Workgroups
Stuck Here
wrosecrans
Morten
Graydon
ACG
Mark
kazord
For I am CJ 
Fishd
Simon B
Hegel
smallerdemon
Ozzy
TransitBiker
JJ
Glitch (over count 1999)
Fi 🏳️⚧️
Lesley Carhart 
Michael Hughes
Big Kumera Energy
Carey
tipjip
🆘Bill Cole 🇺🇦
eddy berthier
Gustavo Litovsky
Krupo
Pēteris Krišjānis
Les Orchard
dazfuller 
Kroc Camen
George Baily
Darrin West
Matt
Ysegrim
Jobu Tupaki
infosec zathras
0bondo7
