Microsoft has finally addressed customer and researcher concerns about automatic screenshots. AI-enabled recall functionThe company promises to further tighten encryption for screen captures and require the use of your face, fingerprint, or PIN to access the feature. Best of all, the tech giant is telling anyone worried about privacy that they can just say “no thanks” when setting up Recall for the first time. Copilot+ PC.
Recall is a new tool built into modern Windows 11 PCs that automatically takes a screenshot of what you’re doing on your PC every few seconds. Your PC then uses an AI model to scan the screenshot for words and images. You can then use the tool to search through your past PC activity and return to web pages or documents you had open. Microsoft CEO Satya Nadella said it’s like your PC has a “photographic memory.”
The feature was meant to be on by default, with users having to turn it off in Settings. Now, Microsoft is changing its stance. Pavan Davulli, the company’s vice president of Windows and Devices, said: I have written On Thursday, the company announced that users will be able to “opt in” to the recall when they set up their PCs, a setting that is off by default, and that users will also need to enable biometric signatures when setting up their PCs. Windows Hello Accessing the recall timeline requires a system, which means your PC will need to have a fingerprint scanner, use the camera, or enter a PIN every time you want to access the feature.
After Microsoft announced the new PC designations at its Build conference last month, concerns were immediately voiced online about the privacy implications. The Mountain View tech giant tried to ease concerns by claiming that the feature runs on the device and that Microsoft doesn’t see any screenshots. Screenshots are stored encrypted on the device and are only accessible to that user profile.
Things went wrong quickly for Microsoft. Albacore tuna The recall was shown to work fine on non-Copilot+ PCs without the NPU that Nadella claimed was inherent to the program. Less than a week later, security researcher Kevin Beaumont Broken You can see that OCR-encrypted plain text in the Windows AppData folder is easily accessible. Recall not only automatically screenshots passwords, financial information, and other sensitive data that appears on the screen, but anyone with even a little hacking experience can easily access the files.
With just a week to go until release, cybersecurity strategist Alex Hagener is offering a free GitHub repository “TotalRecall” is a tool that allows anyone with access to the Copilot+ PC to extract screenshots from internal folders. One of the main concerns so far has been that a bad actor with relatively simple malware could get onto the PC and recover all the data that Recall has accumulated over the year.
Microsoft claims that these screenshots will only be decrypted if the user authenticates with Windows Hello enhanced sign-in security, and all of these new PCs will ship with that security software installed by default.
The Copilot+ PC is set to be released on June 18, but Microsoft had to make the software changes before the new computer series could ship. As for whether the changes reassure security researchers, Beaumont said: I have written“Obviously the devil is in the details, and potentially there are big devils in the details, but there are good elements here,” he added. Still, he added, it’s pretty infuriating that it took “cartoon porgs with ‘portable toilet rentals’ in their Twitter bio and other people on social media” to point out glaring security flaws in Microsoft’s flagship new software feature.
