[usrbinbash]

> But honestly, if somebody has this kind of access to your computer, they have access to your entire life anyway.

Exactly. So please tell me why I would want to essentially allow something like this on my machine?

As for the scifi-esque abilities: All my important information is stored in a personal wiki, which is automatically backed up and encrypted on a backup server. It's fully tagged, its fully searchable. And you know what? I have even set up a pipeline to feed it into a locally run LLM if I want to. Yes, I can do RAG on my personal wiki.

[Nevolihs]

> All my important information is stored in a personal wiki

Ah, there's the crux, no? I dream of a system that automatically captures and allows me to interact with and query against everything I do, every ebook I download, every image, every document, every video, every site. What you're describing isn't this, it's not even the same ballpark.

Recall, even if it isn't perfect, is in the same ballpark.

> Exactly. So please tell me why I would want to essentially allow something like this on my machine?

Because it's useful. I don't understand this. It's like a circular argument. I want a useful feature, I install it on my PC. The security concerns apply regardless of Recall existing.

[usrbinbash]

> The security concerns apply regardless of Recall existing.

Not quite. Because there is a world of difference between an attacker being able to grab information that is being entered or temporarily present, or permanently present and encrypted, and an attacker being able to, within seconds, grab everything the user ever did, watched, saw, entered, etc. on his machine in one fell swoop:

https://doublepulsar.com/recall-stealing-everything-youve-ev...

Quote from the Q&A Section of the post:

"Q. But if a hacker gains access to run code on your PC, it’s already game over!

A. If you run something like an info stealer, at present they will automatically scrape things like credential stores. At scale, hackers scrape rather than touch every victim (because there are so many) and resell them in online marketplaces.

Recall enables threat actors to automate scraping everything you’ve ever looked at within seconds.

During testing this with an off the shelf infostealer, I used Microsoft Defender for Endpoint — which detected the off the shelve infostealer — but by the time the automated remediation kicked in (which took over ten minutes) my Recall data was already long gone."

End Quote.

And this is THE core problem with such a system, that just hoovers up everything, everywhere, all at once: It creates a single point of failure so critical, it will instantly become the prime target of every attack, because no other target is needed any more.

[usrbinbash]

> I dream of a system that automatically captures and allows me to interact with and query against everything I do

Well, I don't.

For starters, because not everything I do generates relevant information for me. All those hours spent surfing through random blogs or wikipedia articles, most news I read, or watching some random scifi series just isn't info that I will ever need to refer back to. It's just noise. Best case scenario, it's useless information that just bloats the database.

Alternative scenario: It messes with the results. Intelligence and statistics are not the same thing. So what if I read some scifi novel on my screen, and the content of that pages embedding just so happens to score higher to a future query than an actually useful document?

In my system, I decide what's relevant information and what isn't. Subsequently, when I use RAG on this, I use it on already curated data. That data is already having structure imposed on it, so it is accessible to me with our without the help of AI.

--------

Then there is also the whole issue about information that is simply too sensitive to store in my personal Wiki. For example: I would NEVER store my bank account details, or API keys in there, even though everything is encrypted. All passwords and similar information go into a separate system FOR A REASON; Single points of failure are bad, and this goes double in security.

Now, a system that takes a screenshot and runs OCR on everything? Cool. What if it does so when I am just running a testscript after setting a temporary envvar in preparation? I don't want that info anywhere outside of my password manager. And yes, this does matter, even if everything is stored locally.

--------

And, of course, we haven't even started on the whole issue of privacy, and how people will feel about a system that basically logs and stores everything the user does. It doesn't matter how useful it could be if people don't feel comfortable with it.