Microsoft Introduces a New Security Challenge!

Microsoft is launching Recall for Copilot Plus PCs, a new Windows 11 tool that keeps track of everything you see and do on your computer and, in return, gives you the ability to search and retrieve anything you’ve done on the device.

Recall is part of the new Copilot Plus PCs that are debuting on June 18th, but experts who have tested the feature are already warning that Recall could be a “disaster” for cybersecurity.

The scope of Recall, which Microsoft has internally called AI Explorer, is incredibly vast — it includes logging things you do in apps, tracking communications in live meetings, remembering all websites you’ve visited for research, and more. All you need to do is perform a “Recall” action, which is like an AI-powered search, and it’ll present a snapshot of that period of time that gives you context of the memory.

As a matter of fact, everything you do on the PC appears on an explorable timeline you can scroll through. You can also search live meetings and videos thanks to Live Captions, which transcribes and even translates speech.

If this technology sounds familiar, Microsoft tried something less powerful in Windows 10 with Timeline but discontinued the feature in 2021. There’s already a very similar app for Mac called Rewind. The software works on M-series Macs and, like Recall, logs everything you do, listens to all of your meetings, and gives you access to a chatbot to recall anything. With Recall, however, you’re getting deep, native integration into Windows 11, while Rewind is a third-party app you have to install and hand over system permissions.

Microsoft states that Recall won’t work with every Windows 11 computer. You’ll have to buy one of several fresh new “Copilot Plus PCs” powered by Qualcomm’s new Snapdragon X Elite chips, which have the neural processing unit (NPU) required for Recall to work. Microsoft expects 50 million laptops to be sold over the next year under the Copilot Plus PC branding. Now, less than 2 weeks out from the Microsoft announcement, the Recall feature has already been cracked to run on unsupported hardware.
https://www.theverge.com/2024/5/31/24168746/microsoft-windows-11-recall-ai-feature-unsupported-hardware

This feature will be enabled by default when you set up a new Copilot Plus PC, and there is no obvious option to disable it during the setup process unless you tick an option that then opens the Settings panel.

Reaction to Microsoft’s Recall announcement has been swift, with privacy campaigners calling it a potential “privacy nightmare”.

Microsoft maintains Recall is an optional experience and that it has built privacy controls into the feature. You can disable certain URLs and apps, and Recall won’t store any material that’s protected with digital rights management tools. Recall also does not take snapshots of certain kinds of content, including InPrivate web browsing sessions in Microsoft Edge, Firefox, Opera, Google Chrome, or other Chromium-based browsers says Microsoft on its explainer FAQ page.

However, Recall doesn’t perform content moderation, so it won’t hide information like passwords or financial account numbers in its screenshots. That data may be in snapshots that are stored on your device, especially when sites do not follow standard internet protocols like cloaking password entry, warns Microsoft.

Microsoft may well find itself needing to “recall” Recall. There are clearly some obvious holes in the way data is stored that need to be addressed, and making this an opt-out experience has privacy campaigners concerned. Recall’s launch comes just weeks after Microsoft CEO Satya Nadella called on employees to make security Microsoft’s “top priority,” even if that means prioritizing it over new features. Perhaps Nadella’s “security above all else priority” is just too little – too late and should have been Microsoft’s goal all along.

Microsoft’s Recall introduction
https://blogs.microsoft.com/blog/2024/05/20/introducing-copilot-pcs/

Microsoft’s Recall overview:
https://learn.microsoft.com/en-us/windows/ai/apis/recall

Thanks again to the Verge