The IT Nerd

Microsoft recently had a bunch of major announcements at Build 2024. The one that we’re going to talk about today is a new feature called Recall. The feature operates in the background and takes screenshots of what you’re doing on your PC while you use it. Whenever you perform a search with Recall, it pulls from all these screenshots to find relevant moments in your PC activity history that might be what you’re looking for, stitching them together into a scrollable timeline. That way you can look through that timeline to find something that you’re looking for. This feature runs on Microsoft’s new PCs that have dumped Intel processors for ARM processors. Like this one or this one, or a new Surface device for example.

Here’s where things get sketchy. While Recall apparently encrypts everything that it is taking a picture of, Recall with the default settings is taking pictures of everything. So if you do online banking, enter your SIN number online, or do anything else that is sensitive, Recall will likely know about it. Think of the fun a threat actor could have if they somehow managed to pwn the PC and got access to that data. And don’t think that threat actors aren’t thinking about giving that a shot as they know that it’s a potential gold mine of information that they can sell on the dark web. Never mind use against you. Now at this point a threat actor would likely have to have physical access to the device as this info is stored locally. But the one thing that I have learned over the years is that threat actors are creative and crafty individuals. So if there’s another attack vector out there that will allow them to grab this data, they will find it. And exploit it.

So it’s not all sunshine and roses for Recall. And the news gets worse for Microsoft as Recall has already gotten the attention of the UK government who are looking into it:

The UK data watchdog says it is “making enquiries with Microsoft” over a new feature that can take screenshots of your laptop every few seconds.

Microsoft says Recall, which will store encrypted snapshots locally on your computer, is exclusive to its forthcoming Copilot+ PCs.

But the Information Commissioner’s Office (ICO) says it is contacting Microsoft for more information on the safety of the product, which privacy campaigners have called a potential “privacy nightmare”.

Microsoft says Recall is an “optional experience” and it is committed to privacy and security.

According to its website, users “can limit which snapshots Recall collects”.

“Recall data is only stored locally and not accessed by Microsoft or anyone who does not have device access,” the firm said in a statement.

And it said a would-be hacker would need to gain physical access to your device, unlock it and sign in before they could access saved screenshots.

But an ICO spokesperson said firms must “rigorously assess and mitigate risks to peoples’ rights and freedoms” before bringing any new products to market.

“We are making enquiries with Microsoft to understand the safeguards in place to protect user privacy,” they said.

If the UK is making these enquiries, then it’s a safe bet that the EU won’t be far behind. Microsoft is already in a bit of a fight with them over not responding to a request for information related to their generative AI features. Thus having Recall pop up on their radar screens would likely be a bad thing for Microsoft. And you have to wonder how many others are going to be knocking on Microsoft’s door in regards to Recall.

My personal thoughts go something like this. This is a feature that I would instantly turn off the second that I got one of these new Microsoft PCs. I simply don’t want something actively recording anything and everything that I do in the background as I simply could not trust it to not pick up something that I don’t want recorded. And while I could tweak settings to try and mitigate what Recall does, I still wouldn’t trust it. Microsoft in my opinion needs to rethink Recall. While it is something that does sound kind of cool on the surface (pun intended), it is also concerning at best because of the privacy implications. And until Microsoft demonstrates that this feature is safe for uses, it’s a feature that I will be avoiding. And you should as well.