• Welcome to TechPowerUp Forums, Guest! Please check out our forum guidelines for info related to our community.

Microsoft Revamps Recall for Copilot+ PCs With a Focus on Security Concerns

Joined
May 30, 2015
Messages
1,937 (0.56/day)
Location
Seattle, WA
Today Microsoft published an extensive blog post about the controversial Recall feature that was intended to launch with Copilot+ enabled Windows 11 PCs. To recap on Recall: Recall was announced as a service that creates and stores 'snapshots' of the user's activity on their PC, and uses the neural processing hardware within a Copilot+ certified machine to filter search requests by the user in order to find what they had previously seen. In effect, it took constant screenshots and would index the contents of those screenshots to assist with vague search queries. Saw a very funny picture in Discord a week ago and can't find it but can describe what it looked like? Search Recall and with the power of neural processing it would sift through its index of stored screenshots and attempt to provide you the exact image you described. Or, you could scroll back through the gallery of snapshots yourself to find what you wanted.

The idea of a program or service running in the background taking screenshots of your activity every few seconds yielded some pretty unsavory reactions from just about everyone. To assuage privacy concerns Microsoft did release an update in June committing to a broad set of security improvements to Recall before the preview would be available to test. This latest blog post titled, "Update on Recall security and privacy architecture", outlines more improvements on top of those announced back in June.





Here is the latest outline for Windows Recall:

Recall requires a Copilot+ PC running Windows 11
Copilot+ PCs are those that meet Microsoft's requirements for AI performance and features, as well as the Secured-core standard. To configure Recall at all a machine needs BitLocker, Device Encryption, TPM 2.0, virtualization-based protection of code integrity, Measured Boot, System Guard Service Launch, and Kernel DMA Protection.

Recall will be exclusively opt-in, remaining disabled by default
During initial Windows set up the user will be given a simple opt-in page for Recall with clearly marked "Yes, save" and "No, don't save" buttons to check. The option to save will continue on to configuring Recall, while the option to not save will disable Recall entirely, though it will not uninstall it. If a user skips past Windows' OOBE setup environment by some method and is never presented with this screen, Recall will default to being disabled.



Recall can be removed entirely at any time
Users will be given the option to completely uninstall and remove Recall from their PC at any time. This will hopefully not be the old "uninstall" Cortana fiasco from Windows 10, where the service would still linger in the background and opportunistically reinstall itself with every Windows update. Recall will be presented under the Optional Features menu for users to configure, and should remain uninstalled across updates.

Recall is tied to Windows Hello Sign-in Security and data is always encrypted
All snapshots and associated information are stored within a vector database and encrypted. The encryption keys are protected via TPM, are tied to only that user's Windows Hello identity, and can only be accessed within a Virtualization-based Security Enclave, or VBS Enclave. This means a PC that has multiple users will not allow each to snoop on the other's activity, even if they somehow get into another user's account all Recall data is protected behind biometrics. Services related to Recall operation are isolated and protected as well to safeguard them against malware. Measures for authentication rate limiting and anti-hammering will also be in place.

Security settings are also stored in the VBS Enclave just like encryption keys, and the same Windows Hello authorization will be required to make any changes. If any tampering is detected, the settings will revert to their secure defaults. A fallback access PIN can be configured after Recall has been set up to avoid losing access should any sensors required for Windows Hello be damaged.



Recall cannot capture private browsing, and more comprehensive privacy settings
Recall's default configuration will not capture snapshots of in-private browsing windows on any supported browsers (including Edge, Chrome, Firefox, and Opera) and users can configure filters to disable snapshots of specific websites or apps. Sensitive content filters are enabled by default using Microsoft's Purview privacy toolset, meaning Recall cannot capture passwords, national ID numbers and credit card information. Users also get options for how long snapshots are retained by Recall, how much disk space is utilized for captures, and for wiping any captures from a specified date range or app. A system tray icon for Recall will allow for pausing snapshots at any time, as well as indicate when snapshots are being saved.

After nearly six months of comprehensive security rework, Microsoft hopes to deliver the Recall preview to Windows Insiders in October for further testing before it decides to ship the feature to the masses.

View at TechPowerUp Main Site | Source
 
Joined
Nov 4, 2005
Messages
11,998 (1.72/day)
System Name Compy 386
Processor 7800X3D
Motherboard Asus
Cooling Air for now.....
Memory 64 GB DDR5 6400Mhz
Video Card(s) 7900XTX 310 Merc
Storage Samsung 990 2TB, 2 SP 2TB SSDs, 24TB Enterprise drives
Display(s) 55" Samsung 4K HDR
Audio Device(s) ATI HDMI
Mouse Logitech MX518
Keyboard Razer
Software A lot.
Benchmark Scores Its fast. Enough.
Ahh the dying kicks of MS, they can't create anything new so they venture into the nuance of it all. The difference of 11 and 10.is like painting a room and calling it a new home, but installing cameras to see where else to make money.

Soon they will be a patent troll.
 
Joined
Jul 5, 2013
Messages
28,121 (6.73/day)
@microsoft
Here's what we want: Choice. Stop forcing this crap on us. Let choose to use it, or not, as we see fit. If we choose not, it is fully removed(deleted) from our systems.

This is the only acceptable scenario.

(Hint: If you don't give us these options we will find a way for forcibly remove these unwanted things from our systems.)
 
Joined
Jun 11, 2017
Messages
280 (0.10/day)
Location
Montreal Canada
Oh great Bit Locker has to be enabled. Our office went to Intune and Bitlocker and it turned into a complete nightmare sometimes. You cannot upgrade any hardware with bit locker 2.0 turned on so if you change say memroy or cpu you have to decrypt the drive. Then upgrade or ghost to new hard drive then you have to encrypt it again. Also some updates can cause bitlocker to ask for a key on boot up this pisses off our users quite a bit. Bitlocker is a total joke IF MS had not invented it ransomware would not have been invented as well.
 

64K

Joined
Mar 13, 2014
Messages
6,773 (1.72/day)
Processor i7 7700k
Motherboard MSI Z270 SLI Plus
Cooling CM Hyper 212 EVO
Memory 2 x 8 GB Corsair Vengeance
Video Card(s) Temporary MSI RTX 4070 Super
Storage Samsung 850 EVO 250 GB and WD Black 4TB
Display(s) Temporary Viewsonic 4K 60 Hz
Case Corsair Obsidian 750D Airflow Edition
Audio Device(s) Onboard
Power Supply EVGA SuperNova 850 W Gold
Mouse Logitech G502
Keyboard Logitech G105
Software Windows 10
How about a GTFO MS? I dont usually swear, but this "feature" takes the spyware context of this OS to the next level. So, pretty please with a cherry on top....

When you say, "No Microsoft. Leave me the hell alone with your unwanted features".

What MS hears, "Just push it on us harder and we will accept it".

MS is the most out of touch with their customers company on this planet.
 
Joined
May 30, 2015
Messages
1,937 (0.56/day)
Location
Seattle, WA
Here's what we want: Choice. Stop forcing this crap on us. Let choose to use it, or not, as we see fit. If we choose not, it is fully removed(deleted) from our systems.

Well the good news is it sounds like you'll be getting exactly what you want. Choice to install it, choice to uninstall it, and if you decide not to choose then you've still made a choice; it won't install and it won't enable.

Oh great Bit Locker has to be enabled.

That part stood out to me too. I understand why they're doing it. They want every single security feature they can muster thrown behind Recall so that nobody can argue it's a security risk. But... BitLocker is just bad. That said anyone worried about the security implications that also hates BitLocker will rejoice in the fact that no BitLocker means no Recall either. Two birds with one stone.
 
Joined
Jul 5, 2013
Messages
28,121 (6.73/day)
Well the good news is it sounds like you'll be getting exactly what you want. Choice to install it, choice to uninstall it, and if you decide not to choose then you've still made a choice; it won't install and it won't enable.
They say that, but as you mentioned, they've said that before and not just with Cortana. It's been an ongoing problem with several unwanted apps. With Cortana, you had to uninstall the app, but the service was not only left intact but left running in it's default state. The only way to remove it is to hop into the CLI and delete it manually.

I understand why they're doing it. They want every single security feature they can muster thrown behind Recall so that nobody can argue it's a security risk.
That isn't an unfair thing, though it doesn't make it acceptable.
 
Joined
Jul 30, 2024
Messages
290 (2.13/day)
Location
Mitten State, USA
System Name Sim Racing PC/Dell XPS 15 7590
Processor AMD Ryzen 7 5800x/Intel Core i7-9750h
Motherboard ASUS TUF B450-Plus II/Dell Laptop MB
Cooling Arctic Freezer A35 CO/laptop cooling
Memory 2*8 GB G.Skill Ripjaws V DDR4-3200/2*8 GB Crucial DDR4-2666 SO-DIMM
Video Card(s) XFX SWFT309 RX 6700 XT/Laptop GTX 1650
Storage 1 TB Crucial 3400 PCIe Gen 4 SSD/Ediloca EN605 512 GB PCIe Gen 3 SSD
Display(s) 77" LG OLED TV (4K@120Hz)/15" Dell integrated panel (1080p@60Hz) and 30" Dell U3011 (1600p@60 Hz)
Case Cougar MX330-G Air / XPS 15 7590 chassis
Audio Device(s) Beyerdynamic DT 770 Pro via Yamaha HT receiver/Integrated speakers or Creative Pebble Plus
Power Supply EVGA 600 BA / Dell 130W laptop brick
Mouse Logitech K400+ / Cherry MW 4500
Keyboard Logitech K400+ / Drop ENTR or E-YOOSO Z-686 or integrated keyboard
VR HMD Meta Quest 2
Software Windows 11 Home/Windows 11 Pro (meaning to try Linux)
This is just making me even more inclined to switch my XPS 15 7590 to Linux. I don't know who'd be comfortable with this on their PC!
 
  • Love
Reactions: JLP
Joined
Sep 9, 2017
Messages
241 (0.09/day)
System Name B20221017 Pro SP1 R2 Gaming Edition
Processor AMD Ryzen 7900X3D
Motherboard Asus ProArt X670E-Creator
Cooling NZXT Kraken Z73
Memory G.Skill Trident Z DDR5-6000 CL30 64GB
Video Card(s) NVIDIA RTX 3090 Founders Edition
Storage Samsung 980 Pro 2TB + Samsung 870 Evo 4TB
Display(s) Samsung CF791 Curved Ultrawide
Case NZXT H7 Flow
Power Supply Corsair HX1000i
VR HMD Meta Quest 3
Software Windows 11
I'm really happy to see that they're going all out on securing Recall. It's going to be a really useful feature for me, but I was ready to completely disable it if it was released as-is. Looks like I won't have to do that anymore.

I'll only be enabling it on my productivity PC and laptop though. I have no need for it on my gaming PC.
 
Joined
Dec 30, 2019
Messages
143 (0.08/day)
Optional? Or do you only have the option to "delete" the data it collects?
 
Joined
Aug 12, 2019
Messages
2,223 (1.14/day)
Location
LV-426
System Name Custom
Processor i9 9900k
Motherboard Gigabyte Z390 arous master
Cooling corsair h150i
Memory 4x8 3200mhz corsair
Video Card(s) Galax RTX 3090 EX Gamer White OC
Storage 500gb Samsung 970 Evo PLus
Display(s) MSi MAG341CQ
Case Lian Li Pc-011 Dynamic
Audio Device(s) Arctis Pro Wireless
Power Supply 850w Seasonic Focus Platinum
Mouse Logitech G403
Keyboard Logitech G110
Dear Microsoft can you not try to break things and improve upon existing platform first
 

JLP

Joined
Jun 19, 2024
Messages
11 (0.06/day)
Location
Slovenia
System Name Tsiolkovsky
Processor AMD Ryzen 5 7600
Motherboard ASUS ROG STRIX B650E-F GAMING WIFI
Cooling AMD Wraith Stealth
Memory 32 GB G.Skill Trident Z5 NEO DDR5-6000 CL30
Video Card(s) PowerColor Hellhound Radeon RX 7900 GRE OC
Storage Samsung 980 Pro 2TB SSD, WD Black 4TB SATA 128MB 7200RPM
Case Corsair Carbide 330R Blackout Edition
Power Supply Seasonic Prime 80 Plus Titanium 850W
Mouse Logitech MX Vertical Advanced Ergonomic
Keyboard Das Keyboard 6 Pro
Software openSUSE Tumbleweed GNU/Linux with KDE Plasma
So glad I switched to GNU/Linux years ago when Windows was already bad. And every time I have to use the new versions of Windows at work it has just gotten more terrible. Just bloated spyware and adware. And getting worse, slowly boiling the frogs.
 
Joined
Oct 2, 2015
Messages
3,152 (0.94/day)
Location
Argentina
System Name Ciel / Akane
Processor AMD Ryzen R5 5600X / Intel Core i3 12100F
Motherboard Asus Tuf Gaming B550 Plus / Biostar H610MHP
Cooling ID-Cooling 224-XT Basic / Stock
Memory 2x 16GB Kingston Fury 3600MHz / 2x 8GB Patriot 3200MHz
Video Card(s) Gainward Ghost RTX 3060 Ti / Dell GTX 1660 SUPER
Storage NVMe Kingston KC3000 2TB + NVMe Toshiba KBG40ZNT256G + HDD WD 4TB / NVMe WD Blue SN550 512GB
Display(s) AOC Q27G3XMN / Samsung S22F350
Case Cougar MX410 Mesh-G / Generic
Audio Device(s) Kingston HyperX Cloud Stinger Core 7.1 Wireless PC
Power Supply Aerocool KCAS-500W / Gigabyte P450B
Mouse EVGA X15 / Logitech G203
Keyboard VSG Alnilam / Dell
Software Windows 11
Yet more reasons to use LTSC builds until frog-protocols or wayland-experimental shows up on Linux distros.
 
Joined
Jul 31, 2024
Messages
419 (3.10/day)
Some People do not care for privacy. Some are just talkers and will never change from their MS Windows and Iphones.

There are other choices for operating systems. Hardly anyone talks about Freebsds.

Yeah, that's a complete deal-breaker. Some people do not and will not use bitlocker.

Some people will not use a microsoft windows online account, secure boot and tpm.
 
Joined
Nov 13, 2007
Messages
10,814 (1.73/day)
Location
Austin Texas
System Name stress-less
Processor 9800X3D @ 5.42GHZ
Motherboard MSI PRO B650M-A Wifi
Cooling Thermalright Phantom Spirit EVO
Memory 64GB DDR5 6400 1:1 CL30-36-36-76 FCLK 2200
Video Card(s) RTX 4090 FE
Storage 2TB WD SN850, 4TB WD SN850X
Display(s) Alienware 32" 4k 240hz OLED
Case Jonsbo Z20
Audio Device(s) Yes
Power Supply Corsair SF750
Mouse DeathadderV2 X Hyperspeed
Keyboard 65% HE Keyboard
Software Windows 11
Benchmark Scores They're pretty good, nothing crazy.
leave it to microsoft to come up with the most unappealing use of consumer AI...

"Hey bro AI is really cool. What if it like... watched you and remembered EVERYTHING YOU DO ON YOUR COMPUTER!?!?!"

"Have you ever thought... Gee I wish a something could watch me 24/7, in a non-biblical, literal sense?"

"Well now it can - THANKS MICROSOFT!"

1727505854795.png
 
Joined
Oct 18, 2017
Messages
187 (0.07/day)
System Name 1080p 144hz
Processor 7800X3D
Motherboard Asus X670E crosshair hero
Cooling Noctua NH-D15
Memory G.skill flare X5 2*16 GB DDR5 6000 Mhz CL30
Video Card(s) Nvidia RTX 4070 FE
Storage Western digital SN850 1 TB NVME
Display(s) Asus PG248Q
Case Phanteks P600S
Audio Device(s) Logitech pro X2 lightspeed
Power Supply EVGA 1200 P2
Mouse Logitech G PRO
Keyboard Logitech G710+
Software Windows 11 24H2
Benchmark Scores https://www.3dmark.com/sw/1143551
I imagine how Microsoft staff reunions go:

- Our popularity is falling off, what should we do?
- Let's put all our efforts on something nobody requested, something very intrusive, with no protection, that everyone will hate.
- Sounds good, let's do it!
 
Joined
Aug 26, 2021
Messages
382 (0.32/day)
I can't help but think about the horrible work place implications. I know that screen recording has been available for over 20 years and your boss was able to watch everything you did but Recall is basically free with being included with the OS and I'd be very surprised if someone including Microsoft isn't already working on a front end client to view these screenshots with ease like tabing right in your photo gallery and when not if it will happen it will make it all easier to abuse.
 
Joined
Nov 2, 2016
Messages
117 (0.04/day)
Well the good news is it sounds like you'll be getting exactly what you want. Choice to install it, choice to uninstall it, and if you decide not to choose then you've still made a choice; it won't install and it won't enable.



That part stood out to me too. I understand why they're doing it. They want every single security feature they can muster thrown behind Recall so that nobody can argue it's a security risk. But... BitLocker is just bad. That said anyone worried about the security implications that also hates BitLocker will rejoice in the fact that no BitLocker means no Recall either. Two birds with one stone.
If only. I bet they'll eventually enable it and just claim the user is responsible for the lack of security if they choose to leave BitLocker disabled. Because eventually it will surface that Recall is for Microsoft so they need it on every PC.
 
Joined
Jan 14, 2019
Messages
12,483 (5.78/day)
Location
Midlands, UK
System Name Nebulon B
Processor AMD Ryzen 7 7800X3D
Motherboard MSi PRO B650M-A WiFi
Cooling be quiet! Dark Rock 4
Memory 2x 24 GB Corsair Vengeance DDR5-4800
Video Card(s) AMD Radeon RX 6750 XT 12 GB
Storage 2 TB Corsair MP600 GS, 2 TB Corsair MP600 R2
Display(s) Dell S3422DWG, 7" Waveshare touchscreen
Case Kolink Citadel Mesh black
Audio Device(s) Logitech Z333 2.1 speakers, AKG Y50 headphones
Power Supply Seasonic Prime GX-750
Mouse Logitech MX Master 2S
Keyboard Logitech G413 SE
Software Bazzite (Fedora Linux) KDE
How could a living human being ever think this was a good idea is beyond me.

leave it to microsoft to come up with the most unappealing use of consumer AI...

"Hey bro AI is really cool. What if it like... watched you and remembered EVERYTHING YOU DO ON YOUR COMPUTER!?!?!"

"Have you ever thought... Gee I wish a something could watch me 24/7, in a non-biblical, literal sense?"

"Well now it can - THANKS MICROSOFT!"

View attachment 365129
Imagine a popup in the middle of a call with your boss:
"Hey, remember that porn clip you watched 2 weeks, 3 days, 6 hours and 18 minutes ago on your browser in incognito mode? Well, we do, and we thought you might like these, too."
 
Top