It IS encrypted. Not well, but it's encrypted.

It's worst than that (as bad as this is)...

Today getting some data on a user is bad as smart hackers can put together the context ... However any guessing the hacker has to do may alert the user before the hacked data can successfully be exploited

Now, a hacker would know exactly where each password goes and worse, they'd could learn the entire workflow of internal systems to successfully imitate a trained user...

This means the hacker could use the stolen bank data and legitimately issue credit cards to anyone they want (for example)

It's no longer "we'll expose some data", now it's "we can use this data to infiltrate your systems and wreak havoc in whatever way we want"

For the kids

Sony BMG copy protection rootkit scandal

Morons:

Sony BMG initially denied that the rootkits were harmful. It then released an uninstaller for one of the programs that merely made the program's files invisible while also installing additional software that could not be easily removed, collected an email address from the user and introduced further security vulnerabilities.

It happens the same on android for some reason

Like 5-8 years ago the google assistant app was able to select and copy text from any app when invoked, I think it was called “now on tap”. Then because they’re google and they’re contractually obligated to remove features after some time, they removed this from the google app and integrated it in the pixel app switcher (and who cares if 99% of android users aren’t using a pixel, they say). The new implementation sucks, as it does ocr instead of just accessing the raw text…

It only works fine with us English and not with other languages. But maybe it’s ok as it seems that google’s development style is us-centric

Hey, yeah… why aren’t they just tapping the font rendering DLL?

…are they tapping the front rendering dll??

Having worked on a product that actually did this, it's not as easy as it seems. There are many ways of drawing text on the screen.

GDI is the most common, which is part of the windows API. But some applications do their own rendering (including browsers).

Another difficulty, even if you could tap into every draw call, you would also need a way to determine what is visible on the screen and what is covered by something else.

That's the thing, it doesn't really know what it's displaying. I can send a bunch of textboxes, but if they're hidden, or drawn off-screen, or underneath another element, then they're not actually displayed.

Text from OCR is one kind of match. Recall also runs visual comparisons with the image tokens stored.

the screenshots and text are just sitting in the appdata folder, which requires no special permission to access

Malware won't even need to wait for the user to access something sensitive, they can just go back through the user's Recall history and get the data for immediate exfiltration. No chance for anti-malware software to update and catch it before it does anything truly bad, it will just always be too late if given even a minute.

What? Bitlocker key tied to MS account and mandatory? What's the point of encryption if the key isn't secret any more?

How are they supposed to feed it into their LLMs later if it's encrypted??

Lol "if". This thing is going to be a massive target.

Someone has already demonstrated using an off-the-shelf infostealer to steal the Recall database from a test computer. It won't take any special skills or technology for this to be a problem.

sudon't please --pretty