Microsoft delayed the release of its Recall feature, originally planned to ship with the new Copilot+ PCs on June 18, in response to security and privacy concerns surrounding the AI tool.
Windows Recall is described by Microsoft as a way to give one’s computer a “photographic memory” by taking “snapshots” of the user’s active screen every few seconds and storing these snapshots in a local database and timeline. Users can then use an AI-driven search on their Copilot+ PC to locate specific webpages or files based on text and visual matches.
The feature’s May 20 announcement was met with swift backlash from customers and security experts who raised alarm over the privacy and security implications of having a searchable database of countless screenshots readily available on one’s computer.
One major concern was the potential for hackers to easily access a treasure trove of sensitive information in the event of a compromise. This risk was compounded by the fact that Microsoft’s Recall FAQ explicitly states it will not hide sensitive details such as passwords or financial account numbers.
A proof-of-concept exploit to extract the Recall database, dubbed "TotalRecall," is already available, and was most recently updated on June 6 to grant the necessary permissions to easily access the database. TotalRecall’s creator, Alex Hagenah, said Thursday that TotalRecall 2.0 was in the works, improving on fellow researcher James Forshaw’s permissions bypass method by adding the ability to impersonate AIXHost.exe tokens.
Users have to opt-in, Recall available to Windows Insiders
In response to criticisms over the feature’s security risks, Microsoft initially announced on June 7 it would be making changes to the upcoming feature, including by requiring users to opt-in to use it rather than having it activated by default, and by requiring proof-of-presence via Windows Hello biometric authentication in order to decrypt, view and search Recall snapshots.
However, Microsoft changed course again on Thursday, updating its June 7 blog post with a notice that the feature would be postponed and be made available only to Windows Insider Program members “in the coming weeks.”
“We are adjusting the release model for Recall to leverage the expertise of the Windows Insider community to ensure the experience meets our high standards for quality and security. The decision is rooted in our commitment to providing a trusted, secure and robust experience for all customers and to seek additional feedback prior to making the feature available to all Copilot+ PC users,” the update states.
The Windows Insider Program (WIP) is free to join and has millions of members, according to WIP homepage, and allows members to preview upcoming and experimental Windows features, as well as provide direct feedback to Microsoft. The company said an upcoming blog post would provide more information about how WIP members can preview Recall, noting that a Copilot+ PC is required to use the feature due to its hardware demands.
The delay announcement came shortly after Microsoft President Brad Smith testified before the U.S. House Committee on Homeland Security Thursday in a hearing focused on security failings leading to the compromise of government email accounts by a China-sponsored threat actor last year.
During his testimony, Smith also defended the Recall feature, stating, “We’ve designed it so it’s off by default so that people have to choose to turn it on and we can share information with them before they make that decision. We’ve designed the feature so that the information always stays on one’s own PC – doesn’t go to Microsoft, it doesn’t go anywhere else. We’ve combined it with a hardening of security and Windows for every part of the computer and not just this feature alone.”
Smith also emphasized that Microsoft is taking “a very comprehensive approach to addressing all of the security and privacy issues,” including by taking public feedback into consideration.
Kevin Beaumont, a security researcher and former senior threat intelligence analyst at Microsoft, who wrote two articles about Recall’s pitfalls and has been a vocal critic of the feature on social media, responded to news of the delay, saying, “Good on Microsoft for finally reaching a sane conclusion.”
“Photographic memory of everything you’ve ever done on a computer has to be entirely optional, with risks explained and be done right.. or not at all. Accountability matters,” Beaumont added. “Microsoft, be better.”
