Brave blocks Microsoft Recall by default

I'm curious about the last paragraph relating to Signal. How, exactly, have Brave managed this without also blocking screenshots? Is there a flag Signal missed?

According to the same paragraph, it's because Signal isn't a "browser app":

> Given that Windows doesn’t let non-browser apps granularly disable Recall, Signal cleverly uses the DRM flag on their app to disable all screenshots.

(emphasis mine)

Apparently, Microsoft consider browsers special:

> While it’s heartening that Microsoft recognizes that Web browsers are especially privacy-sensitive applications, we hope they offer the same granular ability to turn off Recall to all privacy-minded application developers.

Microsoft specifically allows software in the category “browsers” to disable Recall.

How is this category defined? Can an app resister itself as a browser?

Oops. Yeah, I shouldn't have missed that.

Still, does this mean Microsoft maintains an approved browser list for this? Would the various other less-known Chromium/Firefox forks be unable to take advantage of the same thing?

Edit: https://learn.microsoft.com/en-us/windows/ai/recall/recall-w...

> To make sure that Recall doesn't save your user's browsing history while in modes like this, your app can use the SetInputScope function, setting the input scope to IS_PASSWORD.

> Your app must also have a http or https protocol handler registered before SetInputScope will support the behavior described in this article.

I now wonder if you can register a handler that never gets used since you won't be the default browser (and if you do end up as the default somehow, warn the user when called).

> Microsoft specifically allows software in the category “browsers” to disable Recall.

1. "Browser" does not mean "web browser": many kinds of applications can be considered a browser.

2. Even if you identify "browser" with "web browser": Electron apps are basically (web) browsers (though not fully functional ones). Nobody claimed said for a software to be in the "browser" category, it has to be a fully functional web browser.

How does the OS know that foobar application is a [[fully functional] web] browser?

It doesn't. Windows is just checking if there's a protocol handler entry in the registry for http/https.

In theory you don't abuse that because it will come up as a possible browser option for users. :shrug:

(disclaimer: I lead privacy at Brave and wrote the article)

Windows lets browser apps (more technically, apps that have an `http` or `https` protocol handler registered) to use `SetInputScope` function to set `IS_PRIVATE` for a window. We were able to use that and have it apply for all Brave windows, and thus granularly turn off Recall without affecting non-Recall screen readers or screenshot capabilities.

Signal doesn't have protocol handlers for `http` and `https`, so it can't do the same.