https://www.theregister.com/2024/05/22/windows_recall/ # # Sign in / up The Register(r) -- Biting the hand that feeds IT # # # Topics Security Security All SecurityCyber-crimePatchesResearchCSO (X) Off-Prem Off-Prem All Off-PremEdge + IoTChannelPaaS + IaaSSaaS (X) On-Prem On-Prem All On-PremSystemsStorageNetworksHPCPersonal TechCxOPublic Sector (X) Software Software All SoftwareAI + MLApplicationsDatabasesDevOpsOSesVirtualization (X) Offbeat Offbeat All OffbeatDebatesColumnistsScienceGeek's GuideBOFHLegalBootnotesSite NewsAbout Us (X) Special Features Special Features All Special Features Cloud Infrastructure Week Cybersecurity Month Blackhat and DEF CON Sysadmin Month The Reg in Space Emerging Clean Energy Tech Week Spotlight on RSA Energy Efficient Datacenters Vendor Voice Vendor Voice Vendor Voice All Vendor Voice Amazon Web Services (AWS) Business Transformation Amazon Web Services (AWS) New Horizon in Cloud Computing DDN Google Cloud Data Transformation Google Gemini Hewlett Packard Enterprise: AI & ML solutions Hewlett Packard Enterprise: Edge-to-Cloud Platform Intel vPro VMware (X) Resources Resources Whitepapers Webinars & Events Newsletters [aiml] AI + ML 236 comment bubble on white Giving Windows total recall of everything a user does is a privacy minefield 236 comment bubble on white It's only a preview, and maybe it should stay there ... forever icon Richard Speed Wed 22 May 2024 // 13:11 UTC # Build Microsoft's Windows Recall feature is attracting controversy before even venturing out of preview. Like so many of Microsoft's AI-infused products, Windows Recall will remain in preview while Microsoft refines it based on user feedback - or simply gives up and pretends it never happened. The principle is simple. As noted earlier, Windows takes a snapshot of a user's active screen every few seconds and dumps it to disk. The user can then scroll through the archive of snapshots to find what were doing some time back, or query an AI system to recall past screenshots by text. [aiml] The Windows 11 feature is supposed to eventually expand to allow users to pull up anything that happened recently on their Copilot+ PC and interact with or use it again, as the system logs all app activity, communications, and so on, as well as by-the-second screenshots, to local storage for search and retrieval. [aiml] [aiml] Microsoft, which was just scolded by the US government for lax security, said: "Recall will also enable you to open the snapshot in the original application in which it was created, and, as Recall is refined over time, it will open the actual source document, website, or email in a screenshot. This functionality will be improved during Recall's preview phase." Improvements will certainly be needed, particularly in how the function deals with privacy. [aiml] Taking aside the fact that BitLocker will only come into play on Windows 11 Pro or Enterprise devices - everyone else must make do with "data encryption" - Windows Recall has the potential to be a privacy nightmare. According to Microsoft, all the processing takes place on a customer's device, and the snapshots stay there. The IT giant also says that for the relatively small number of users running its Edge browser - with a market share of just under 13 percent, according to Statcounter - InPrivate sessions won't be snapped, nor will DRM content. It will not hide information such as passwords or financial account numbers. That data may be in snapshots stored on your device Microsoft said in its FAQs that its snapshotting feature will vacuum up sensitive information: "Recall does not perform content moderation. It will not hide information such as passwords or financial account numbers. That data may be in snapshots stored on your device, especially when sites do not follow standard internet protocols like cloaking password entry." But that's OK - a user can opt to filter out sites, right? Only if you're using Edge. In the deeper documentation for the service, Microsoft said: "To filter out a website from a snapshot, you must be using Microsoft Edge." "Recall won't save any content from your private browsing activity when you're using Microsoft Edge or a Chromium-based browser." [aiml] So, at least it's more than Edge when it comes to respecting private tabs. Tarquin Wilton-Jones, a developer and privacy expert at Vivaldi, a Chromium-based browser vendor, earlier expressed hope that the automatic respecting of the InPrivate mode - or Incognito mode for Chrome - would apply outside of Edge. "It almost certainly will not respect any browser's attempts to clear browsing data, where the browser could historically have been in any screenshots," he added. Recall stores not just browser history, but also data that users type into the browser with only very coarse control over what gets stored "It also cannot respect GDPR requests to delete personal data exposed in an application when the source data is deleted by a data controller, and for this reason, it is clearly a massive privacy risk for any organization that handles private data. Who knows what other private data, or sensitive information, it might store in a freely accessible format?" Mozilla's Chief Product Officer Steve Teixeira told The Register: "Mozilla is concerned about Windows Recall. From a browser perspective, some data should be saved, and some shouldn't. Recall stores not just browser history, but also data that users type into the browser with only very coarse control over what gets stored. While the data is stored in encrypted format, this stored data represents a new vector of attack for cybercriminals and a new privacy worry for shared computers. "Microsoft is also once again playing gatekeeper and picking which browsers get to win and lose on Windows - favoring, of course, Microsoft Edge. Microsoft's Edge allows users to block specific websites and private browsing activity from being seen by Recall. Other Chromium-based browsers can filter out private browsing activity but lose the ability to block sensitive websites (such as financial sites) from Recall. * Microsoft Build 2024 looks like it's more about AI fluff than developer stuff * Microsoft smartens up Edge for Business with screenshot blocking, logo branding, more * Microsoft AI Studio opens for business, with a nod to safety * Intel, AMD take a back seat as Qualcomm takes center stage in Microsoft's AI PC push "Right now, there's no documentation on how a non-Chromium based, third-party browser, such as Firefox, can protect user privacy from Recall. Microsoft did not engage our cooperation on Recall, but we would have loved for that to be the case, which would have enabled us to partner on giving users true agency over their privacy, regardless of the browser they choose." Jake Moore, Global Cybersecurity Advisor at ESET, noted that while the feature is not on by default, its use "opens up another avenue for criminals to attack." In essence, a keylogger is being baked into Windows as a feature Moore warned that "users should be mindful of allowing any content to be analysed by AI algorithms for a better experience." Cybersecurity expert Kevin Beaumont was scathing in his assessment of the technology, writing: "In essence, a keylogger is being baked into Windows as a feature." AI expert Gary Marcus was blunter: "F^ck that. I don't want my computer to spy on everything I ever do." Probe incoming To add to Microsoft's woes, a spokesperson for the UK's Information Commissioner's Office said today: "We expect organisations to be transparent with users about how their data is being used and only process personal data to the extent that it is necessary to achieve a specific purpose. Industry must consider data protection from the outset and rigorously assess and mitigate risks to people's rights and freedoms before bringing products to market. "We are making enquiries with Microsoft to understand the safeguards in place to protect user privacy." At present, Windows Recall feels like it was put together with insufficient thought. Microsoft has said that "Recall is a key part of what makes Copilot+ PCs special." However, as Microsoft has pointed out, it remains in preview. Enterprises are unlikely to go anywhere near it until the privacy and security questions it raises have been answered. The GDPR aspect alone makes it a non-starter for all but the most determined of organizations. Microsoft's customers and Windows enthusiasts alike have been clamoring for something in the operating system to make all the AI hype worthwhile. But, in its current form, Windows Recall is not it. (r) Get our Tech Resources # Share More about * AI * Copilot * Microsoft More like these x More about * AI * Copilot * Microsoft * Microsoft Build * Windows 11 Narrower topics * Active Directory * Azure * Bing * BSoD * Excel * Exchange Server * Gemini * Google AI * GPT-3 * GPT-4 * HoloLens * Internet Explorer * Large Language Model * LinkedIn * Machine Learning * MCubed * Microsoft 365 * Microsoft Edge * Microsoft Ignite * Microsoft Office * Microsoft Surface * Microsoft Teams * .NET * Neural Networks * NLP * Office 365 * OS/2 * Outlook * Patch Tuesday * Pluton * SharePoint * Skype * SQL Server * Star Wars * Tensor Processing Unit * Visual Studio * Visual Studio Code * Windows 10 * Windows 7 * Windows 8 * Windows Server * Windows Server 2003 * Windows Server 2008 * Windows Server 2012 * Windows Server 2013 * Windows Server 2016 * Windows Subsystem for Linux * Windows XP * Xbox * Xbox 360 Broader topics * Bill Gates * OpenAI * Operating System * Self-driving Car * Windows More about # Share 236 comment bubble on white COMMENTS More about * AI * Copilot * Microsoft More like these x More about * AI * Copilot * Microsoft * Microsoft Build * Windows 11 Narrower topics * Active Directory * Azure * Bing * BSoD * Excel * Exchange Server * Gemini * Google AI * GPT-3 * GPT-4 * HoloLens * Internet Explorer * Large Language Model * LinkedIn * Machine Learning * MCubed * Microsoft 365 * Microsoft Edge * Microsoft Ignite * Microsoft Office * Microsoft Surface * Microsoft Teams * .NET * Neural Networks * NLP * Office 365 * OS/2 * Outlook * Patch Tuesday * Pluton * SharePoint * Skype * SQL Server * Star Wars * Tensor Processing Unit * Visual Studio * Visual Studio Code * Windows 10 * Windows 7 * Windows 8 * Windows Server * Windows Server 2003 * Windows Server 2008 * Windows Server 2012 * Windows Server 2013 * Windows Server 2016 * Windows Subsystem for Linux * Windows XP * Xbox * Xbox 360 Broader topics * Bill Gates * OpenAI * Operating System * Self-driving Car * Windows TIP US OFF Send us news --------------------------------------------------------------------- Other stories you might like If you find Microsoft's Copilot offerings overwhelming, it's no wonder: There are 130-plus of them now Build And now add Copilot connectors and extensions to that AI + ML21 May 2024 | 17 Microsoft Build 2024 looks like it's more about AI fluff than developer stuff Comment Windows? We're the Copilot company now AI + ML22 May 2024 | 21 Intel, AMD take a back seat as Qualcomm takes center stage in Microsoft's AI PC push Build Plus: Windows set for ML-powered always-watching-you Recall feature Personal Tech21 May 2024 | 20 The sky's the limit for 5G app developers How application developers can scale new apps and services across multiple geographies quickly and easily Sponsored Feature [aiml] Microsoft AI Studio opens for business, with a nod to safety Build Redmond is ready to help folks build AI 'copilots' Software21 May 2024 | 4 IBM Consulting bought into Microsoft's Copilot - now it'll help customers do the same It's called Copilot Runway, not run away AI + ML13 May 2024 | 12 Wondering when AI will turn up at your work? Microsoft says look behind you Research lands weeks after the Copilot company said it was still trying to convince customers of benefits AI + ML9 May 2024 | 24 Microsoft's carbon emissions up nearly 30% thanks to AI Company will require certain suppliers to run on 100% carbon-free electricity ... by 2030 On-Prem16 May 2024 | 37 Microsoft's deal with UAE's G42 sparks fears over true destination of AI exports US politicos worry that all roads lead to renminbi AI + ML23 May 2024 | 6 Microsoft smartens up Edge for Business with screenshot blocking, logo branding, more Build And real-time video translation for things like this: !Apestas, Redmond! Software21 May 2024 | 27 UK competition cops say Microsoft's stake in Mistral is not a merger Watchdog drops official probe but IT giant's deal with Inflection AI and Amazon's with Anthropic still in play AI + ML17 May 2024 | 1 Windows Insiders to fly solo while Copilot rollout frozen Perhaps just make sure the stuff that is already there works properly? OSes7 May 2024 | 15 The Register icon Biting the hand that feeds IT About Us* * Contact us * Advertise with us * Who we are Our Websites* * The Next Platform * DevClass * Blocks and Files Your Privacy* * Cookies Policy * Privacy Policy * Ts & Cs * Do not sell my personal information Situation Publishing Copyright. All rights reserved (c) 1998-2024 no-js