So I was using Copilot today to complete my assignment on ways to distinguish between identical twins and then Copilot started listing out all the apps I have installed on my laptop and how many tabs I had opened on Microsoft Edge. Is all this data collected by default? Is this data associated with me or anonymously collected? Can I opt out of data collection?
Link to video

EDIT: Link to chat

Satya Nadella says Windows PCs will have a photographic memory feature called Recall that will remember and understand everything you do on your computer by taking constant screenshots

https://x.com/tsarnick/status/1792680674060832829

Completely different subject from what I was asking co-pilot but I had this response out of nowhere at the end of a reply asking about mouse sensitivity by the built in co-pilot in win11, I will link to screencap here https://imgur.com/a/IuBnknt
https://imgur.com/a/6wylZ8v

{"OS Version":"Windows 11 Core","Preferred Languages":["en-GB"],"Installed Apps":["Firefox","Discord","GitHub Desktop","Unity Hub","Git Bash","Performance Monitor","Computer Management","Task Manager","Event Viewer","Task Scheduler","Resource Monitor","OneDrive","Visual Studio Code","Control Panel","File Explorer","Windows Media Player Legacy","Remote Desktop Connection","Run","Microsoft Edge","Signal","Character Map","Disk Clean-up","Command Prompt","Component Services","Defragment and Optimise Drives","iSCSI Initiator","Windows Memory Diagnostic","System Configuration","ODBC Data Sources (64-bit)","On-Screen Keyboard","Steps Recorder","Recovery Drive","Services","Windows Defender Firewall with Advanced Security","Windows PowerShell","Windows PowerShell ISE","7-Zip File Manager","Logitech G HUB","VLC media player","WordPad","Battle.net","Steam","ODBC Data Sources (32-bit)","Windows PowerShell (x86)","Windows PowerShell ISE (x86)","Registry Editor","Settings","NVIDIA Control Panel","Windows Security","Media Player","Films & TV","Tips","Game Bar","News","Microsoft To Do","Maps","Calculator","Terminal","Sticky Notes","Photos","Weather","Clock","Feedback Hub","Mail","Calendar","Camera","Snipping Tool","Microsoft Store","Paint","Solitaire & Casual Games","Power Automate","Notepad","Microsoft Clipchamp","Xbox","Get Help","Phone Link","WhatsApp","Quick Assist","Microsoft 365 (Office)"]}

What the actual ?!¬

Could you help me explain why it’s a crazy request for one of my kid’s teachers to want to track my kid using life360?

I’m getting worked up and frustrated because I am not being understood. Am I wrong? I think it is absolutely nuts for the teacher to want the kids in the team to all share their location with her and each other.

Am I overthinking it?

What is WeChat and Who is Tencent?

WeChat is the most popular app in China) which is owned by Tencent. This app functions similar to Facebook messenger and is a way for people to chat individually or in groups.

The issue it used to help the Chinese government track, detain, & punish people who share opinions that are not in line with the Chinese government. The US Department of state sites that Tencent's WeChat is China's number one tool for cracking down on dissent (page 27 has the TLDR).

What do they want Riot Games players install?

They are requiring users to install an anti-cheat app called Vanguard which has a couple issues:

First it runs at the kernel level which is much higher the standard administrator access most apps require, here is a good post breaking that down. The TLDR is it would have more or less infinite access to do what it wants on your machine & will not necessarily go away even if you factory reset your machine.

Second it runs on boot (effectively meaning whenever your PC is on). This is very strange since most anti-cheat apps run when your game is running and not on boot. Most users will not know how to disable it running on boot and will leave the default.

Third and most importantly it is owned by Tencent who could be required by law to use this to collect data on foreign users and conceal that they are doing so. Meaning employees could legally be obligated to make false public statements on what types of data this is being used to collect. Tencent also has a history of abusing this level of access to collect data on the Chinese government's behalf.

How is this different than TikTok, WeChat, & others?

If you install TikTok on IOS it may see your locations, contacts, etc. Which could still be a problem if used maliciously (i.e. they could see you go to the bar every night), however the cross app access it has is not to the point where it could see your keystrokes and see your banking credentials. For the grief IOS gets, there are at least some protections on what patches can go in.

Lets say you had a 100% non-malicious anti-cheat running at the kernel level. It would needs to patch over time to catch new cheats that are discovered so it would have a way to receive patches. Kernel live patching is totally reasonable, so there is nothing here that would not pass a code review. However that assumes you trust the source of the patch.

The problem though is if it got a patch that was malicious it would immediately execute that code with more or less infinitely elevated privilege. So whoever was in charge of patching could have any computer with this software on it do anything they wanted. They could also do this in a way where it was not clear to the user it was happening.

Here the company who partners with the Chinese government for WeChat is the one in control of the patching.

Title says it all. + They asked me if i would like the review team to take a look at it in a review, like yeah sure, show my stuff to everybody..

EDIT: It was a text file of websites my company wanted to advertise on, two of them happened to be porn related. Literally the name of the site flagged the file.

EDIT 2: It is a business account and it is not shared with anyone, for internal use only on the administrator's account.

What was I thinking when I decided that it was a good idea to give Google access to all of my photos? Not only does that app have every picture I ever took, but any metadata the pictures have too. This includes location, time and date, camera data, faces, etc. I find the way the app recognizes and groups photos based on faces very creepy. It can even tell people in old childhood pictures apart.

As bad as it sometimes feels to give away my data to these companies, nothing made me feel as bad as giving Google Photos all of this data about me. I'll never use this app ever again.

Firefox users are "no longer supported" by Best Buy if they have a Firefox privacy setting enabled. screenshot

Enabling the "privacy.resistFingerprinting" setting can make browsing the web safer by limiting how well sites can track you across the web.

Read more about the setting and how to enable it here. But you're browsing this subreddit so you're probably already aware of this.

It's clear that Best Buy is doing a horrible job of detecting if a browser is supported. My user agent is correctly communicating that I have the latest (as of this writing) version of Firefox - but this is not enough to convince Best Buy I'm worthy of viewing their cutting-edge website.

What's your reasoning when you get asked this question because you won't just tell someone the pin to your device and instead unlock yourself

I was reporting a webpage issue to Google when it prompted me to include screenshots it had already captured of both of my desktops (it showed large thumbnails). WTH is a web browser doing taking screenshots of other apps and data I'm privately using on my PC? Google is not granted permission to anything in my Windows privacy settings.

To see it for yourself, click the three dots in the upper right hand corner of Google Chrome, select "Help" and then "Report an Issue". A window will pop up for you to enter info. The screenshot of your desktops is shown there.

I am locked out of clocking in and out because the "privacy" policy for the service they use just updated, and is mostly about where and how they can sell our data. Since I didn't click Accept, the privacy policy page is the only page on our employee portal that I can see. It prevents me from clocking in.

I get that we are tracked everywhere we go and I live with/ manage that. The problem here is twofold:

1. The data they collect is known to be reliable
2. They have much more personal data -- I.E. the data I thought was confidential is actually being sold to hundreds of company like social security number

Now, perhaps my direct employer is just trying to save a few bucks by hiring this outside company. I donno. I hear there are kickbacks though.

I first noticed an issue where the HR company was doing a lot of direct marketing. I tried to shut that off, but was still getting marketing emails. For example, one email marketing a holiday sale on luxury goods at the bottom said “Please note that you cannot opt-out of an email that is required to provide you information about your relationship with TriNet.”

What gives here?! I think most of my colleagues clicked through it without reading it. I refuse to give in, though. I did not get told part of my job description was to be farmed for advertising and hedge fund data. Any advice out there?

NB: My original need for "cross-platform" was specifically Android and Windows. As such, much of the conversation has leaned that way although there is certainly room here for conversation for others. Authy's desktop shutdown affects Windows users disproportionately (see below for Mac info). Therefore, the ideal solution would be a direct replacement for Authy which supports both a desktop (or possibly web-based) \and* mobile app. Also, while welcome to be discussed, please know Authy was **free**, and many users don't consider a paid alternative the ideal solution.*

*** WARNING ***

It is possible that this thread, and the opportunity of Authy shutting down, is bringing some bad actors onto the stage. I just got an email that a user had posted a suggestion for the following website: https://www.free-authenticator.com/. The product is called Verifyr. It appears to be a cross-platform 2FA solution. When I clicked on my reddit email notification, the post had already been removed. I do not know if this was reported or removed by the original poster.

I know NOTHING about this product although it does seem to be available on multiple app stores and therefore has likely been verified to some degree by Microsoft/Google/etc. It may be a totally legitimate app, but it also may be a scam. It is possible there are other scam softwares out there and it shouldn't have to be said (especially in this /r) that you should be very careful who you are giving your info to. If you know anything about Verifyr (or any other questionable solutions) please feel free to discuss.

Again, I am just using Verifyr as one example. Please make sure you vet your solutions before placing trust in them (hopefully that is redundant to say in this /r!).

*** UPDATE ***

You CAN export your tokens from Authy! Please read summary here (info courtesy of /u/Masterbetatesta)

Options - Keep on keeping on with Authy (i.e. workarounds):

• If you are a Windows 11 user you can install the Authy Android app on Windows using the Android Subsystem for Windows. I put instructions here. This seems like a decent solution, at least mid-term for Win11 users. I have some caveats under the instructions. UPDATE: Microsoft has stupidly announced they are terminating support for the Android Subsystem. I'm not sure when they will actually be pulling the ability to install, but it appears that some support will last through March of 2025. I recommend using the WSABuilds solution listed below as it will likely be supported by the community as long as possible.
  
• If you are a Windows 10 user you can also use the Authy app via Android Subsystem for Windows. This is not technically supported by Microsoft, but there is a project called WSABuilds that brings it to Windows 10. /u/Aptimex tells us about it here.
• Likewise, if you are a user of an M1/M2 powered Apple Mac devices, the iOS app will also be available to download.
• You can also install the Android emulator software Bluestacks on your PC/Mac. Not going to get into the configuration here, but with it you can install pretty much any android app on your machine. It is basically a VM for Android and as such will be more cumbersome to use, but definitely an option to continue using the mobile app on desktop/laptop.

Other viable options suggested (thanks to those in thread):

• Zoho OneAuth - I'm adding this to the top of the list, though I hate to do so. It is being placed here due to its parity with Authy. It has a Desktop app and mobile apps and they sync. And if you are used to Authy, this seems like it delivers pretty much the same experience. I had a bit of a headache setting it up, and I think it might be a little wonky at times, but for the most part it seems to work. The main reason I don't like recommending this is that it appears to have the same problem as Authy in that it will not allow you to export your codes (except in a proprietary format to import into another instance of OneAuth). So, if you like being locked down like you were with Authy, this will oblige! Zoho is an India-based company which has been a known player in the CRM space for quite a few years.
  UPDATE: Zoho Android app appears to have added a feature to export codes into a more compatible format in case you need to export to a third-party. I have not tested it yet, but this bodes well. I'm not sure how comfortable I feel with a foreign-entity backed authentication provider, but OneAuth clearly the successor to Authy in terms of feature parity at this point.
• ente Authenticator - Android app that also provides a web interface you can use on your PC. Thanks to /u/0le for reporting apparently they have a desktop app in Beta right now. Please Note: I don't know much about ente. They appear to have their primary focus on Photos. They have some info about them here and claim to have their code audited. However it isn't clear that this is their authenticator code, the advertised photo code, or both. They also appear to be based out of India. I'm not saying any of this is bad, but they seem to be a new company and I believe I would like to know more about them and their infrastructure before handing over all my OTP codes.
• Various apps in the Keepass ecosystem. Depending if you are using any of them now for your main passwords, you may chose another one just for your 2FA/TOTP needs. Personally I am a KeePass/KP2A user, and may decide to also install KeePassXC (desktop) and KeePassDX (android) to host just my 2FA as a direct replacement for Authy. You can integrate into existing KeePass installs just remember it might not be smart to host 2FA and passwords in the same database and some versions of KP aren't great with multi-database, so using separate apps might help! To be to those of you not familiar with KeePass. It is self-hosted. Your information is stored in encrypted files and the KeePass applications do not have built-in sync. However you can use various types of online storage. For instance I keep my encrypted database in Google Drive and can easily access it on my phone and laptop (and it remains synced, though there may be more delay than built-in native sync). It is definitely more work then an OOB solution, but if you like the idea of self-hosted and a larger ecosystem of apps, this might be an option for you.
• Also, some love for Mac Users - /u/zax_elite in the thread has mentioned open source Ravio. I have no experience, but quickly glancing at the page it appears that they offer both a Mac and iOS version and the syncing is accomplished through iCloud. If you already trust Apple (and, of course you do) this seems like a fairly secure option.
• For those of you more technically minded, you can apparently get this functionality by hosting your own Bitwarden server. There is obviously a bit of setup here, and probably some cost.Unless you can piggy-back it on-top of existing deployments you have you are likely to spend as much yearly as you would to just pay for a premium BW account (~$10/year), but its an option.

Non-viable options for those who want parity with Authy:

• 2FAS - Android app with browser extension. However you are required to answer push notifications from your phone to send to the browser...so you still need your phone.
• Authenticator.cc - This has been mentioned by a couple of people in the thread. I wasn't going to add it because it was just one of many other ones out there that don't really have parity. But /u/DHX-238 did a little write-up which piqued my interest, so I played around with it and had my own response to him over here. In short, it is a browser-only vault that offers good import/export through QR codes.

Notable Mentions (might provide similar functionality, but at a cost or some other drawback)

• Bitwarden - Need the Authenticator feature which requires the premium plan ($10/year)
• Probably more, I will keep updating some...Don't have the time/desire to add every single other paid solution that might work or one's that provide only partial parity to what Authy provided us cross-platform users.

Other Info from Twilio:

Business customer guide: End of Life (EOL) for use of Authy API with Twilio Authy Desktop apps%20for%20use,))

User guide: End of Life (EOL) for Twilio Authy Desktop app

------------------------------------------------------------------------------------------------------------------------------

OP:

I just got a message on the Authy desktop app that support will be ending for it on 3/19/24.

I don't know if it will just stop working completely at that point, or if it might still work but will be unsupported (and likely stop working all together shortly thereafter?).

I know that not everyone loves Authy but I switched to it a couple of years ago because at the time it was the only solution I knew of which had an app for both Android and PC. For me, this is a must as I don't want to have to resort to pulling out my phone every time I am seated in front of my PC.

Can someone recommend alternatives that offer cross-platform support. Bonus points if there is an easy migration pass from Authy.

Up until now, I have been entering my gym with a physical card. They have recently started forcing users to create an account, download the gym's app and access the premises by scanning the QR code in the app. I don't want to create an account and download the app for data privacy reasons. I never agreed to this when signing up. I understand I may have to just to screenshot the code and delete the app afterwards, but I want to avoid that.

• I am wondering if this is legal as it feels quite coercive?
• Is there any governing body that regulates this type of coercive behaviour? Or a nonprofit I can turn to?
• I am wondering what my options are when more companies start mimicking this behaviour, as I have noticed this becoming a trend.

I don't want any more apps and accounts. I am EU based. I hope this is the appropriate subreddit, any info is appreciated! Thank you :)

1. Google is suddenly demanding personal ID documents even to make simple app purchases (via the Play store). Customers are blocked from all purchases until they comply.
2. This includes users with a perfect payment history

SCREENSHOTS link in comments