Microsoft Teams will soon block screen capture during meetings

* Naive screencaps are much less traceable to the leaker than a naive photo is. Yes, someone can strip out EXIF data, but we've seen over and over again that they generally don't. And even without EXIF a naive framing on the photo is more likely to expose information about the location or identity of the person who took it.

* A photo of a webinar is going to (barring serious postprocessing) look much less official and be less legible than a screenshot, so the use cases for illicit captures are going to be fewer. Few people are going to try to take a phone photo of the top-secret meeting and use the slide in their next team all-hands, but many might forget the rules and than snap a screenshot really quickly for later use.

* Just having the ability to block the easy method of screen captures helps avoid cases where the person doing the capturing isn't actively malicious, just ill-informed. If a normal employee attempts a screenshot and is reminded they're not supposed to do that, they're not going to pull out their phone to take a photo, they're going to say "oops" and move on.

Yeah, there are threat models that won't be stopped here, but most of corporate InfoSec is wrapped up in protecting against pretty lame threat models that would benefit from this—mostly uninformed/ignorant employees screwing up without intending to be a threat.

This feature provides value because it increases friction. It won't stop really determined and motivated users from leaking, but it'll make leaks, especially accidental leaks / those due to hacks, a lot less common.

The same applies to DRM, "security by obscurity", social media post editing / deletion, dark patterns, loss leaders, promotions and coupons, the list is endless.

If your user is a perfectly rational being with infinite time and infinite tech savviness, the proverbial "spherical cow", those features make 0 sense. Just like spherical cows, though, those users don't actually exist, and so friction matters.

That doesn't mean friction is infinite, though. It's too easy to overestimate it and fall into the trap of thinking that "users won't bother doing this, it doesn't matter if this combination of actions loses us money, it's too bothersome", and then get very surprised very quickly.

The people using this feature aren’t going to imagine it as 100% protective against any and all possible methods of exfiltrating data. It’s a feature for discouraging casual data capture and dissemination. It serves to remind people doing spontaneous captures that they aren’t supposed to, but everyone knows a dedicated person could find a way to get that photo if they really, really want.

That doesn’t make it useless. Every time you raise the level of difficulty for accomplishing something, a percentage of attempts are thwarted or discouraged. As it turns out in the real world, raising the bar even a little tiny bit is effective in thwarting or discouraging the majority of attempts across the average user base. You’re not defeating the dedicated attackers, but you’re reducing the overall number of successful attacks and even attempts.

The same is true for things like the office firewall blocking websites: Yes, we all know a dedicated engineer can create a way around it, but it’s going to stop most employees from getting to those sites and serve as a reminder to others that they’re not supposed to access them.

I'm an example of that threat. I'm a freelancer who often has video calls with new clients. Sometimes I surreptitiously screen cap demos or presentations. It would be very difficult to use a phone that way without breaking the conversational flow.

Other supposed workarounds would require much more preplanning. Like I'd need to know that there was something worth capturing.

This feature would help make that less likely to happen accidentally or “accidentally.” It wouldn’t stop deliberate leaks but that’s a different problem.

My company recently configured Slack for mobile to disallow copying text.

It’s all about diffusing that responsibility.

Yeah, if you've got corporate espionage going on this isn't going to stop someone from lifting your slides and taking them elsewhere. But the most common culprit of corporate information security violations isn't a spy, it's a well-meaning employee who didn't hear, remember, or correctly interpret the request to not record the meeting.

Blocking the most common way in which this kind of well-meaning but ill-informed employee would break the expected security rules does work. It's just getting flak here because people are imagining a much more exciting threat model.

It probably works as well as the company firewall blocking sites or the data exfiltration detection blocking companies from being stolen.

Everyone knows they’re not perfect and can be defeated by a sufficiently motivated attacker, but in practice they stop most casual attempts and discourage others.

Why do you think they can't prevent on-device screenshots/screen recording can't be prevented when you control the entire stack?

Asking participants not to screen record or take screenshot was standard practice at every company I’ve worked at where we discussed anything like financials or sensitive business plans.

Many people still take screenshots of things they think are useful. Things still get shared though emails and occasionally posted on social media.

I have worked with various secure chamber VPN and VNC systems that make it quite difficult to record or screenshot. These are companies where their IP is worth billions of dollars and everyone wants a piece of it. It's difficult enough that it's not worth the effort to try and work around it. The rare time I really need something for debugging, I'll take a photo with my cameraphone, but it rarely comes to that.

Because it's that much harder, I record a lot less of it. Likewise for all the other engineers I work with. Friction won't stop it entirely, but it will make it far less frequent.

That you think the only attack vector here is a 3rd party device means you haven't really considered everything. Consider screenshots that might happen for many reasons, including malicious software, or even normal software someone might be using, and accidental exposure.

So it’s something critically important for you to get your job done, but also something that’s not worth writing a couple sentence e-mail about, but also going to block your work while you sit around and wait all day for it?

Communication is the foundation of any office job. If you’re in a meeting with these people, just ask in the meeting? If you can’t, send an email during the meeting and you haven’t lost any time. It’s really not as hard as you’re trying to make it sound.

I generally discourage people from using ChatGPT for office communication, but to be honest if writing a simple e-mail request to get something you need for your job triggers this level of overthinking, you might benefit from letting it at least draft the email to get you started and past the analysis paralysis.

This is not a problem with this feature, this is a problem with your office's expectations surrounding communication.

At my workplace this exchange looks like a slack message along these lines:

> Hey, can I get a copy of the info from side 10? I'll use it for $X.

It's essentially a guardrail. It can be easily circumvented if someone was being actively malicious.

Many people are babies.

Sheesh, we've come to a state where browsers can no longer be referred to as "user agents".