Jac on Nostr: Bruce Schneier on Microsoft Recall: đ§ Because Recall is âdefault allowâ (it ...
Bruce Schneier on Microsoft Recall: đ§
Because Recall is âdefault allowâ (it relies on a list of things not to record) ... itâs going to vacuum up huge volumes and heretofore unknown types of data, most of which are ephemeral today. The âwe canât avoid saving passwords if theyâre not maskedâ warning Microsoft included is only the tip of that iceberg. Thereâs an ocean of data that the security ecosystem assumes is âout of reachâ because itâs either never stored, or itâs encrypted in transit. All of that goes out the window if the endpoint is just going to...turn around and write it to disk. (And local encryption at rest wonât help much here if the data is queryable in the userâs own authentication context!)
This:
The fact that Microsoftâs new Recall thing wonât capture DRM content means the engineers do understand the risk of logging everything. They just chose to preference the interests of corporates and money over people, deliberately.
This:
Microsoft Recall is going to make post-breach impact analysis impossible. Right now IR processes can establish a timeline of data stewardship to identify what information may have been available to an attacker based on the level of access they obtained. Itâs not trivial work, but IR folks can do it. Once a system with Recall is compromised, all data that has touched that system is potentially compromised too, and the ML indirection makes it near impossible to confidently identify a blast radius.
This:
You may be in a position where leaders in your company are hot to turn on Microsoft Copilot Recall. Your best counterargument isnât threat actors stealing company data. Itâs that opposing counsel will request the recall data and demand it not be disabled as part of e-discovery proceedings.
Because Recall is âdefault allowâ (it relies on a list of things not to record) ... itâs going to vacuum up huge volumes and heretofore unknown types of data, most of which are ephemeral today. The âwe canât avoid saving passwords if theyâre not maskedâ warning Microsoft included is only the tip of that iceberg. Thereâs an ocean of data that the security ecosystem assumes is âout of reachâ because itâs either never stored, or itâs encrypted in transit. All of that goes out the window if the endpoint is just going to...turn around and write it to disk. (And local encryption at rest wonât help much here if the data is queryable in the userâs own authentication context!)
This:
The fact that Microsoftâs new Recall thing wonât capture DRM content means the engineers do understand the risk of logging everything. They just chose to preference the interests of corporates and money over people, deliberately.
This:
Microsoft Recall is going to make post-breach impact analysis impossible. Right now IR processes can establish a timeline of data stewardship to identify what information may have been available to an attacker based on the level of access they obtained. Itâs not trivial work, but IR folks can do it. Once a system with Recall is compromised, all data that has touched that system is potentially compromised too, and the ML indirection makes it near impossible to confidently identify a blast radius.
This:
You may be in a position where leaders in your company are hot to turn on Microsoft Copilot Recall. Your best counterargument isnât threat actors stealing company data. Itâs that opposing counsel will request the recall data and demand it not be disabled as part of e-discovery proceedings.