Signal to Windows Recall: Drop dead
Windows, as all but the most besotted Microsoft fans know, has historically been a security disaster. Seriously, what other program has a dedicated day each month to reveal its latest security holes?
But now, Windows Recall, the AI-powered “feature” that continuously takes snapshots of your screen to create a searchable timeline of everything you do, has arrived for Copilot+ PCs running Windows 11 version 24H2 and newer.
After a year of controversy and multiple delays prompted by widespread privacy and security concerns, Microsoft has significantly changed Recall’s architecture. The feature is now opt-in, requires Windows Hello biometric authentication, encrypts all snapshots locally, filters out sensitive data such as credit card numbers, and allows users to filter out specific apps or websites from being captured.
I am so unimpressed. A few days ago, in the latest Patch Tuesday release, Microsoft revealed five — count ’em, five! — zero-day security holes in Windows alone. Do you expect me to trust Recall with a track record like this?
Besides, even if I don’t enable the feature, what if our beloved federal government decides that for our protection, it would be better if Microsoft turned on Recall for some users? After all, it’s almost impossible to run Windows these days without having a Microsoft ID, making it easy to pick and choose who gets what “update.”
Other people feel the same way. Recall remains a lightning rod for criticism. Privacy advocates and security experts continue to warn that the very nature of Recall capturing and storing everything displayed on a user’s screen every few seconds is inherently too risky. Even if you don’t use the feature yourself, what about all the people you communicate with who might have Recall turned on? How could you even know?
A friend at the University of Pennsylvania told me that the school has examined Microsoft Recall and found that it “introduces substantial and unacceptable security, legality, and privacy challenges.” Sounds about right to me.
Amusingly enough, Kaspersky, the Russian security company that has its own security issues, also states that you should avoid Recall. Why? Well, yes, when you first activate Recall, you are required to use biometric authentication. After that, your PIN will do nicely. Oh, and its automatic filtering of sensitive data is unreliable. Sure, it will stop taking snapshots when you’re in private mode on Chrome or Edge. Vivaldi? Not so much.
And as Kaspersky points out, if you use videoconferencing with automatic transcription enabled, Recall will save a complete call transcript detailing who said what. Oh boy!
Signal, the popular secure messaging program, wants nothing to do with this. It has introduced a new “Screen security” setting in its Windows desktop app, specifically designed to protect its users from Recall.
Enabled by default on Windows 11, this feature uses a Digital Rights Managementflag to stop any application, including Windows Recall, from capturing screenshots of Signal chats. When Recall or other screenshot tools try to capture Signal’s window, it will produce a blank image.
Why? In a blog post, Signal explained:
“Although Microsoft made several adjustments over the past twelve months in response to critical feedback, the revamped version of Recall still places any content that’s displayed within privacy-preserving apps like Signal at risk. As a result, we are enabling an extra layer of protection by default on Windows 11 in order to help maintain the security of Signal Desktop on that platform, even though it introduces some usability trade-offs. Microsoft has simply given us no other option.”
Actually, you do have another option: Desktop Linux. I said it ages ago, and I’ll say it again now. If you really care about security on your desktop, you want Linux.
#signal #windows #recall #drop #dead
Signal to Windows Recall: Drop dead
Windows, as all but the most besotted Microsoft fans know, has historically been a security disaster. Seriously, what other program has a dedicated day each month to reveal its latest security holes?
But now, Windows Recall, the AI-powered “feature” that continuously takes snapshots of your screen to create a searchable timeline of everything you do, has arrived for Copilot+ PCs running Windows 11 version 24H2 and newer.
After a year of controversy and multiple delays prompted by widespread privacy and security concerns, Microsoft has significantly changed Recall’s architecture. The feature is now opt-in, requires Windows Hello biometric authentication, encrypts all snapshots locally, filters out sensitive data such as credit card numbers, and allows users to filter out specific apps or websites from being captured.
I am so unimpressed. A few days ago, in the latest Patch Tuesday release, Microsoft revealed five — count ’em, five! — zero-day security holes in Windows alone. Do you expect me to trust Recall with a track record like this?
Besides, even if I don’t enable the feature, what if our beloved federal government decides that for our protection, it would be better if Microsoft turned on Recall for some users? After all, it’s almost impossible to run Windows these days without having a Microsoft ID, making it easy to pick and choose who gets what “update.”
Other people feel the same way. Recall remains a lightning rod for criticism. Privacy advocates and security experts continue to warn that the very nature of Recall capturing and storing everything displayed on a user’s screen every few seconds is inherently too risky. Even if you don’t use the feature yourself, what about all the people you communicate with who might have Recall turned on? How could you even know?
A friend at the University of Pennsylvania told me that the school has examined Microsoft Recall and found that it “introduces substantial and unacceptable security, legality, and privacy challenges.” Sounds about right to me.
Amusingly enough, Kaspersky, the Russian security company that has its own security issues, also states that you should avoid Recall. Why? Well, yes, when you first activate Recall, you are required to use biometric authentication. After that, your PIN will do nicely. Oh, and its automatic filtering of sensitive data is unreliable. Sure, it will stop taking snapshots when you’re in private mode on Chrome or Edge. Vivaldi? Not so much.
And as Kaspersky points out, if you use videoconferencing with automatic transcription enabled, Recall will save a complete call transcript detailing who said what. Oh boy!
Signal, the popular secure messaging program, wants nothing to do with this. It has introduced a new “Screen security” setting in its Windows desktop app, specifically designed to protect its users from Recall.
Enabled by default on Windows 11, this feature uses a Digital Rights Managementflag to stop any application, including Windows Recall, from capturing screenshots of Signal chats. When Recall or other screenshot tools try to capture Signal’s window, it will produce a blank image.
Why? In a blog post, Signal explained:
“Although Microsoft made several adjustments over the past twelve months in response to critical feedback, the revamped version of Recall still places any content that’s displayed within privacy-preserving apps like Signal at risk. As a result, we are enabling an extra layer of protection by default on Windows 11 in order to help maintain the security of Signal Desktop on that platform, even though it introduces some usability trade-offs. Microsoft has simply given us no other option.”
Actually, you do have another option: Desktop Linux. I said it ages ago, and I’ll say it again now. If you really care about security on your desktop, you want Linux.
#signal #windows #recall #drop #dead
·48 Views