3
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 07 Jun 2024
3 points (100.0% liked)
Cryptography
452 readers
1 users here now
cryptography (noun). The discipline concerned with communication security (eg, confidentiality of messages, integrity of messages, sender authentication, non-repudiation of messages, and many other related issues), regardless of the used medium such as pencil and paper or computers.
This community is for links about and discussion of cryptography specifically. For privacy technology more generally, use !privacy.
This community is explicitly not about cryptocurrency; see !crypto for that.
founded 3 years ago
MODERATORS
I'm not sure encryption is the issue here. Why do you think this data needs to be more encrypted than the rest of the user's home directory, which should hopefully already be protected by full-disk encryption if the user cares about that sort of thing?
Because it would be really easy to extract a lot of data out of that database, which is what Microsoft Recall is being criticized for
But if an attacker has decrypted access to a user's home directory, aren't they screwed anyway?
I guess that's right
Not necessarily, recall might contain more information than what is currently saved on disk. For example bank statements, accessible though their web application, protected by 2FA.
A recall that ran entirely locally—which is absolutely a necessary precondition for it to count as "secure"—would necessarily contain only information stored on disk because where else would it put the data it's collecting/analyzing?
In other words, if it screenshots you accessing your back via website, that screenshot would be stored locally and would be just as protected by full disk encryption as the rest of your files.
I disagree, I'm with OP. screenshots contain (previously) temporary information from all sorts, such as a private meeting between 2 parties with confidencial, eyes only, data. And for going towards extreme privacy end of spectrum, proving you know someone is already a red flag.
If someone has a trojan running with access to the disk, yes it's a big deal. But it's still worth limiting the extent of it by putting extra protection in the things such this. A hacker can have the screenshot files but won't be able to do anything with it.
Unless you're constantly running a secure overwrite of your free disk space, ram and CPU caches, no data is truly temporary. There is always a possibility for recovery by a skilled enough adversary.
Well yea that's the point: unencrypted recall database would make this sooo much easier.