https://www.wired.com/story/microsoft-recall-off-default-security-concerns/ Skip to main content Open Navigation Menu To revisit this article, visit My Profile, then View saved stories. Close Alert WIRED Microsoft Will Switch Off Recall by Default After Security Backlash * Security * Politics * Gear * Backchannel * Business * Science * Culture * Ideas * Merch More Search * Security * Politics * Gear * Backchannel * Business * Science * Culture * Ideas * Merch * Podcasts * Video * Newsletters * Magazine * Events * WIRED Insider * WIRED Consulting * Jobs * Coupons Andy Greenberg Security Jun 7, 2024 12:11 PM Microsoft Will Switch Off Recall by Default After Security Backlash After weeks of withering criticism and exposed security flaws, Microsoft has vastly scaled back its ambitions for Recall, its AI-enabled silent recording feature, and added new privacy features. Microsoft signage Photograph: David Ramos/Getty Images Save Save When Microsoft named its new Windows feature Recall, the company intended the word to refer to a kind of perfect, AI-enabled memory for your device. Today, the other, unintended definition of "recall"--a company's admission that a product is too dangerous or defective to be left on the market in its current form--seems more appropriate. On Friday, Microsoft announced that it would be making multiple dramatic changes to its rollout of its Recall feature, making it an opt-in feature in the Copilot+ compatible versions of Windows where it had previously been turned on by default, and introducing new security measures designed to better keep data encrypted and require authentication to access Recall's stored data. "We are updating the set-up experience of Copilot+ PCs to give people a clearer choice to opt-in to saving snapshots using Recall," reads a blog post from Pavan Davuluri, Microsoft's corporate vice president for Windows and devices. "If you don't proactively choose to turn it on, it will be off by default." The changes come amid a mounting barrage of criticism from the security and privacy community, which has described Recall--which silently stores a screenshot of the user's activity every five seconds as fodder for AI analysis--as a gift to hackers: essentially unrequested, preinstalled spyware built into new Windows computers. In the preview versions of Recall, that screenshot data, complete with the user's every bank login, password, and porn site visit would have been indefinitely collected on the user's machine by default. And though that highly sensitive data is stored locally on the user's machine and not uploaded to the cloud, cybersecurity experts have warned that it all remains accessible to any hacker who so much as gains a temporary foothold on a user's Recall-enabled device, giving them a long-term panopticon view of the victim's digital life. "It makes your security very fragile," as Dave Aitel, a former NSA hacker and founder of security firm Immunity, described it--more charitably than some others--to WIRED earlier this week. "Anyone who penetrates your computer for even a second can get your whole history. Which is not something people want." In addition to making Recall an opt-in feature, Microsoft's Davuluri also writes that the company will make changes to better safeguard the data Recall collects and more closely police who can turn it on, requiring that users prove their identity via its Microsoft Hello authentication function any time they either enable Recall or access its data, which can require a PIN or biometric check of the user's face or thumbprint. Davuluri says Recall's data will remain encrypted in storage until the user authenticates. All of that is a "great improvement," says Jake Williams, another former NSA hacker who now serves as VP of R&D at the cybersecurity consultancy Hunter Strategy, where he says he's been asked by some of the firm's clients to test Recall's security before they add Microsoft devices that use it to their networks. But Williams still sees serious risks in Recall, even in its latest form. Most Popular * The Snowflake Attack May Be Turning Into One of the Largest Data Breaches Ever Security The Snowflake Attack May Be Turning Into One of the Largest Data Breaches Ever By Matt Burgess * This Hacker Tool Extracts All the Data Collected by Windows' New Recall AI Security This Hacker Tool Extracts All the Data Collected by Windows' New Recall AI By Matt Burgess * Ikea Will Pay You Real Money to Work in Its Virtual Roblox Store Culture Ikea Will Pay You Real Money to Work in Its Virtual Roblox Store By Megan Farokhmanesh * Inside the Biggest FBI Sting Operation in History Backchannel Inside the Biggest FBI Sting Operation in History By Joseph Cox * Many users will turn on Recall, he points out, partly due to Microsoft's high-profile marketing of the feature. And when they do, they'll still face plenty of unresolved privacy problems, from domestic abusers that often demand partners give up their PINs to subpoenas or lawsuits that compel them to turn over their historical data. "Satya Nadella has been out there talking about how this is a game changer and the solution to all problems," Williams says, referring to Microsoft's CEO. "If customers turn it on, there's still a huge threat of legal discovery. I can't imagine a corporate legal team that's ready to accept the risk of all of a user's actions being turned over in discovery." For Microsoft, the Recall rollback comes in the midst of an embarrassing string of cybersecurity incidents and breaches--including a leak of terabytes of its customers' data and a shocking penetration of government email accounts enabled by a cascading series of Microsoft security slipups--that have grown so problematic as to become a sticking point given its uniquely close relationship with the US government. Those scandals have escalated to the degree that Microsoft's Nadella issued a memo just last month declaring that Microsoft would make security its first priority in any business decision. "If you're faced with the trade-off between security and another priority, your answer is clear: Do security," Nadella's memo read (emphasis his). "In some cases, this will mean prioritizing security above other things we do, such as releasing new features or providing ongoing support for legacy systems." By all appearances, Microsoft's rollout of Recall--even after today's announcement--displays the opposite approach, and one that seems more in line with business as usual in Redmond: Announce a feature, get pummeled for its glaring security failures, then belatedly scramble to control the damage. You Might Also Like ... * Navigate election season with our WIRED Politics Lab newsletter and podcast * Don't think breakdancing is an Olympic sport? The world champ agrees (kinda) * How researchers cracked an 11-year-old password to a $3M crypto wallet * The uncanny rise of the world's first AI beauty pageant * Give your back a break: Here are the best office chairs we've tested [undefined] Andy Greenberg is a senior writer for WIRED covering hacking, cybersecurity, and surveillance. He's the author of the new book Tracers in the Dark: The Global Hunt for the Crime Lords of Cryptocurrency. His last book was *Sandworm: A New Era of Cyberwar and the Hunt for the Kremlin's Most... Read more Senior Writer * TopicsMicrosoftWindowscybersecuritysecurityvulnerabilities Read More This Hacker Tool Extracts All the Data Collected by Windows' New Recall AI This Hacker Tool Extracts All the Data Collected by Windows' New Recall AI Windows Recall takes a screenshot every five seconds. Cybersecurity researchers say the system is simple to abuse--and one ethical hacker has already built a tool to show how easy it really is. Matt Burgess Microsoft's Recall Feature Is Even More Hackable Than You Thought Microsoft's Recall Feature Is Even More Hackable Than You Thought A new discovery that the AI-enabled feature's historical data can be accessed even by hackers without administrator privileges only contributes to the growing sense that the feature is a "dumpster fire." Andy Greenberg Microsoft's New Recall AI Tool May Be a 'Privacy Nightmare' Microsoft's New Recall AI Tool May Be a 'Privacy Nightmare' Plus: US surveillance reportedly targets pro-Palestinian protesters, the FBI arrests a man for AI-generated CSAM, and stalkerware targets hotel computers. Dell Cameron Microsoft Deploys Generative AI for US Spies Microsoft Deploys Generative AI for US Spies Plus: China is suspected in a hack targeting the UK's military, the US Marines are testing gun-toting robotic dogs, and Dell suffers a data breach impacting 49 million customers. Dhruv Mehrotra AI Is Your Coworker Now. Can You Trust It? AI Is Your Coworker Now. Can You Trust It? Generative AI tools such as OpenAI's ChatGPT and Microsoft's Copilot are becoming part of everyday business life. But they come with privacy and security considerations you should know about. Kate O'Flaherty Secrecy Concerns Mount Over Spy Powers Targeting US Data Centers Secrecy Concerns Mount Over Spy Powers Targeting US Data Centers A coalition of digital rights groups is demanding the US declassify records that would clarify just how expansive a major surveillance program really is. Dell Cameron Inside the Biggest FBI Sting Operation in History Inside the Biggest FBI Sting Operation in History When a drug kingpin named Microsoft tried to seize control of an encrypted phone company for criminals, he was playing right into its real owners' hands. Joseph Cox Mysterious Hack Destroyed 600,000 Internet Routers Mysterious Hack Destroyed 600,000 Internet Routers Plus: A whistleblower claims the Biden administration falsified a report on Gaza, "Operation Endgame" disrupts the botnet ecosystem, and more. Dell Cameron WIRED WIRED is where tomorrow is realized. It is the essential source of information and ideas that make sense of a world in constant transformation. The WIRED conversation illuminates how technology is changing every aspect of our lives--from culture to business, science to design. The breakthroughs and innovations that we uncover lead to new ways of thinking, new connections, and new industries. More From WIRED * Subscribe * Newsletters * FAQ * WIRED Staff * Editorial Standards * Archive * RSS * Accessibility Help Reviews and Guides * Reviews * Buying Guides * Mattresses * Electric Bikes * Fitness Trackers * Streaming Guides * Coupons * Submit an Offer * Become a Partner * Coupons Contact * Code Guarantee * Advertise * Contact Us * Customer Care * Jobs * Press Center * Conde Nast Store * User Agreement * Privacy Policy & Cookie Statement * Your California Privacy Rights (c) 2024 Conde Nast. All rights reserved. WIRED may earn a portion of sales from products that are purchased through our site as part of our Affiliate Partnerships with retailers. The material on this site may not be reproduced, distributed, transmitted, cached or otherwise used, except with the prior written permission of Conde Nast. Ad Choices Select international site United States * Italia * Japon * Czech Republic & Slovakia * * * * * *