Microsoft’s new “Recall” feature, billed as an innovation for searching and browsing on your PC, has been met with concerns from some cybersecurity experts. The system, integrated into the new Copilot+ PCs and based on AI, captures desktop screenshots every few seconds, creating a database that could easily be exploited by attackers.
Recall is the function that remembers everything we do with the PC. But how much space does it take up on disk?
Go to further information
Kevin Beaumont, cybersecurity expert and former Microsoft collaborator, demonstrated how an automated program can extract Recall’s plaintext data, despite the company’s reassurances. Beaumont called Recall an “infostealer,” which is an information-stealing program capable of collecting sensitive data such as passwords, messages and even web activity.
Recall takes a screenshot of your screen every 5 seconds if the content on the screen is different from the previous “snapshot”. These screenshots are encrypted and stored locally on your PC, but the AI uses OCR software (which recognizes characters from printed text, also used on scanners for decades) to extract text from screens and make it searchable.
This text OCR data is always stored locally, but in a plain text SQLite database which hackers could also have access to. The storage folder is the well-known AppData.
Although Microsoft has announced the ability to disable the feature or exclude specific websites and applications, Recall integration is opt-out. The Verge’s Tom Warren was able to try out a preview version of that it was on by default when setting up a new PC. The user can only deactivate it later.
It would instead be advisable to make it an opt-in function, rather than an opt-out one. And, given recent findings, Microsoft is likely to review Recall ahead of its release alongside the new Copilot+ PCs on June 18th.
