Microsoft Recall

New Microsoft CoPilot PCs come with Recall functionality.

What is it and do I want it?

Basically, the core idea of Recall is to give your PC a "photographic memory" of everything you've seen and done, making it instantly searchable. Sounds cool, maybe you do want it?

​To sweeten the deal and make you a tad more comfortable, all the data is stored locally on your PC and you can search through it all with the help of CoPilot anytime, even if you are offline… but…

Microsoft's "Recall" feature has sparked significant cybersecurity and privacy concerns. While Microsoft has implemented safeguards, the nature of the feature inherently introduces new risks.

These include:
​

• Potential for Unauthorized Access/Disclosure: All the points, from "Centralized Data Repository" to "Accessibility to Compromised Data," describe scenarios where sensitive user data could be accessed by unauthorized individuals (attackers, malware, or even unintentionally by others).
• Increased Attack Surface: "Centralized Data Repository" and "Massive Data Collection" fundamentally increase the amount and type of data an attacker could potentially steal if they compromise your device. More data means more opportunities for leverage.
• Bypassing Security Controls: "PIN/Biometric Reliance Vulnerability" and "Living Off the Land Attacks" highlight how existing device security (like a PIN or biometrics) can be bypassed or exploited once the system is compromised, allowing access to the Recall data.
• Data Integrity and Confidentiality Concerns: "Incomplete Sensitive Information Filtering" means Recall might fail to protect data you assume it would, compromising its confidentiality.
• Privacy Compromise with Security Ramifications: "Erosion of Private Communications" (your data being captured on someone else's device without your consent) is a significant privacy concern that can have security implications (e.g., exposing sensitive conversations or credentials).
• Forensic and Legal Exposure: "Undeniable Digital Footprint" creates a permanent record that could be used against you in various contexts, which is a risk to personal privacy and potentially security.
• User Error/Misunderstanding: "Opt-in vs. Default Confusion" and "User Error" are risks because they show how users might inadvertently expose themselves due to a lack of understanding or misconfiguration, which can be exploited.

So if you’re in the market for a new PC and you buy one with Microsoft-Copilot, consider turning Recall OFF!

Ep335

Image created by AI