Light

Episode #976 Quiz

The 50 Gigabyte Privacy Bomb
Date: 2024-05-28 | Length: 2 hrs | Episode page at twit.tv

About this episode

Microsoft’s Recall on Copilot+ Windows 11 PCs captures screen images every few seconds, encrypts and indexes them locally in a SQLite database, and stores roughly three months on 25GB, scaling to 150GB on 1TB drives. It excludes InPrivate and DRM content, but not passwords or account numbers, creating a searchable privacy liability.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: What browser-side change did Steve describe as a way to make Google return 'web search mode' results and avoid AI Overview content?

Question 1

What browser-side change did Steve describe as a way to make Google return 'web search mode' results and avoid AI Overview content?

Disabling personalized results in the Google account privacy page Switching Google to image-only results from the search settings Appending udm=14 to the Google search URL Appending noai=1 to the Google search URL

Question 2: According to the episode, what did LastPass finally start doing for vault-stored URLs, and why did Steve criticize the timing?

Question 2

According to the episode, what did LastPass finally start doing for vault-stored URLs, and why did Steve criticize the timing?

Encrypting URLs at rest, years after the architecture was created Signing URLs with per-device certificates, to prevent tampering Deleting URLs entirely, after users requested stronger privacy Hashing URLs before storage, because plaintext URLs were impossible to protect

Question 3: What split-tunneling detail did Andrew raise as a reason that forcing all traffic through a VPN interface would not work in many corporate environments?

Question 3

What split-tunneling detail did Andrew raise as a reason that forcing all traffic through a VPN interface would not work in many corporate environments?

Corporate laptops usually lack the CPU to encrypt all tunneled traffic VPN concentrators cannot authenticate roaming users unless traffic is split DNS queries must always bypass the tunnel to reach internal resolvers Teams and Slack traffic is often deliberately allowed outside the tunnel

Question 4: What four-key security problem did Richard describe in the grocery-store alarm system audit?

Question 4

What four-key security problem did Richard describe in the grocery-store alarm system audit?

Every store shared one master PIN that was never changed Only 70 PINs were valid across a 7,000-code namespace Each regional manager had a unique eight-digit code that was rotated weekly Nearly 7,000 disarming PINs were valid across about 10,000 possible codes

Question 5: What storage layout detail did Steve cite from the Recall database investigation he referenced near the end of the episode?

Question 5

What storage layout detail did Steve cite from the Recall database investigation he referenced near the end of the episode?

Recall data is stored in a per-user JSON log file Recall data is stored in a SQLite3 database Recall data is stored only in volatile memory and never written to disk Recall data is stored in an encrypted tar archive

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.