Microsoft Recall on Copilot+ PC: testing the security and privacy implications

Some background on Recall

Last year, Microsoft announced Recall, a feature which screenshots your PC every few seconds, OCRs the screenshots and produces a searchable text database of everything you’ve ever viewed or written from your computer. I took a look at it at the time:

Recall: Stealing everything you’ve ever typed or viewed on your own Windows PC is now possible.

Back then, I found the implementation being tested was woefully incomplete, the design was it would be enabled by default, the database wasn’t encrypted (other than standard BitLocker encryption.. which didn’t work when threat modelling info stealers), and it stored sensitive information like credit card numbers and such by design.

Recall is rolling out to end user devices now. This blog is going to explore what has changed, and raises concerns about how well the changes work. Skip forward to “What’s better” and “What’s questionable” below to get to the meat in this piece.

Long story short, it was pretty clear Microsoft hadn’t thought through the implications. There were also numerous press articles claiming the feature had been developed in closed groups at Microsoft, and hadn’t involved appropriate security and privacy oversight, and hadn’t been sent out to Windows Insider testing.

The plan was for the feature to be available on all Copilot+ PCs — Microsoft’s new AI branding for home systems — at launch in mid 2024.

Following my post and coverage online, it was announced Recall would become opt-in.. then it wouldn’t be available on Copilot+ PC at launch, then it was delayed for Windows Insider testing, then it was delayed again.

It was, frankly, a pretty baffling and rare self own from Microsoft. It reminded me a lot of the Xbox One E3 launch, where Microsoft execs were misaligned with what customers wanted, and fumbled the messaging in what they were offering.

Recall met a significant social media backlash, with videos about Recall racking up millions of views. The two widest shared sentiments were ‘Hell no’ and ‘Why would anybody want this feature?’. Even in mainstream publications, to this day, any article talking about Recall w

[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.