Should Microsoft Recall ever reappear I plan to keep checking how secure it is, because the next evolution of security cannot be Microsoft pouring petrol onto the infostealer fire.

Infostealer malware is swiping millions of passwords, cookies, and search histories. It’s a gold mine for hackers—and a disaster for anyone who becomes a target.

https://www.wired.com/story/infostealer-malware-password-theft/

XDA Developers, who were a good source of behind the scenes info during the Microsoft Recall saga, are saying Microsoft have kicked Recall into the long grass and they think it may never launch. https://www.xda-developers.com/thread/microsoft-wants-you-to-forget-about-copilot-recall-it-seems/

It’s been almost two months since Microsoft said it would launch for Insiders in “weeks” instead.

Microsoft now say Recall will available for Insider testing in October on select Copilot+ PCs.

As a community we’ll need to test the security implications out extensively.

Due to hardware requirements this will obviously be a problem, unless we can hack it to install on non-NPU systems again - I don’t know if that has been ‘fixed’ or not.

https://www.theverge.com/2024/8/21/24225439/microsoft-recall-windows-ai-feature-october-testing

Recall is back.

Overall the planned changes here are much more robust.

Some of the things are boomerangs - eg they said it wasn’t uninstallable weeks ago, but it is now. Also they said it wasn’t developed under Secure Future Initiative a few months ago.. but now say it was originally under SFI.

The proof is in the pudding obviously so hands on tests will be required. They’ve locked it to Copilot+ PC systems now, which will limit research.

https://www.theverge.com/2024/9/27/24255721/microsoft-windows-recall-ai-security-improvements-overhaul-uninstall

Microsoft have recalled Recall again.

It still hasn't even made it to Insider preview yet, that's been delayed too, now in December.

Good, by the way. They should take the time to get it right. I still don't know what they were thinking when they had the CEO stand on stage and say it was launching on devices 6 months ago and would be fully secure, when they hadn't even done a basic security review of it.

https://www.theverge.com/2024/10/31/24284572/microsoft-recall-delay-december-windows-insider-testing

I'd be surprised if it is released in December btw, as Redmond is a ghost town in the office from basically now until mid January.

I guess a cynical version is they're trying to rush out the Insider preview during Christmas so nobody actually reviews it.. but, well, I don't think that would happen as it'd be another own goal. It probably needs 6 months in Insider release with a bug bounty, to avoid exploits dropping like Joker 2 at the box office on release.

In a newly released blog entitled "Windows: AI-powered, cloud-enabled, and secure", Microsoft say the business versions of Windows will ship with Recall disabled by default - IT departments will have to enable the feature before it is available.

This is a smart move and frankly it was incredible that the original idea was to ship this enabled by default in business - it was never, ever going to fly and hopefully Microsoft is rightly humbled by the experience.

https://techcommunity.microsoft.com/blog/windows-itpro-blog/windows-ai-powered-cloud-enabled-and-secure/4299069

Microsoft are getting positive press for calling Recall “one of the most secure experiences it has built”.

I’d point out - they haven’t provided a Preview build to Insiders still, and there’s been no externally provided build (outside of NDA), so nobody has been able to assess the security and talk about it. There’s no specific bug bounty for it either.

When they first announced Recall, they called it totally secure - which was laughably inaccurate. It feels like a lot of premature high fiving

Microsoft Recall is now available for testing.

https://www.theregister.com/2024/11/22/microsoft_recall_release/

It’s only available on Qualcomm Snapdragon-powered Copilot+ PCs. My feeling is we’re probably going to want to hook one up to the internet and hack RDP for unlimited sessions, to allow research - I’ll look into it.

I’ve been told Recall is eligible for bug bounty as part of the Insider programme. I think the process is supposed to be sandboxed so in theory (my reading) the payout limit should be $20k.

Microsoft are rolling out Recall to users in Windows Insider (testing) before a wider rollout to all compatible systems.

It's definitely one to watch (and yes, I am) from a security point of view.

https://www.bbc.co.uk/news/articles/cj3xjrj7v78o

I've took a look at the past year of work Microsoft has done on Recall, which is due to roll out to compatible Windows devices soon

tl;dr it's much better from a security and privacy point of view. My partner managed to hack my Recall memory in 5 minutes to browse prior Signal discussions, by guessing my Windows Hello PIN.

There's a bunch of risks people who enable it need to understand.

https://doublepulsar.com/microsoft-recall-on-copilot-pc-testing-the-security-and-privacy-implications-ddb296093b6c

Tabletop scenario for you:

Employee gets into a dispute with employer, leaves, had sensitive role. Employer revokes access, devices etc. Employee had logged in via BYOD to email, IM etc.

Due to Recall, employee walks away with 6 months of screenshots of everything she's ever worked on in a text indexed form - every email, chat, document, Teams call with video snapshots, transcripts of verbal calls etc - even if they set M365 to not store documents locally.

What does the employer do now?

Signal have rolled out an update to all users that stops Microsoft Recall from capturing Signal conversations.

I’ve tested this and it works. Brilliant work by the @signalapp team. 💪

They call on Microsoft to build better, as there was no standardised way as an app developer to do this. Because Signal is open source, now app developers have a template to protect their users from Windows.

https://signal.org/blog/signal-doesnt-recall/

I found an interesting Microsoft Recall issue with the latest version - Recall is enabled on my PC, but the tray icon (bottom right) saying it is running is missing.

Edit: after a reboot, it's back. I'll keep an eye on it. After the latest Windows Update the UI wasn't visible, but it was still recording.

The Register took a look at Microsoft Recall and found it captured personal information, such as social security numbers and such in its database.

They also found they could access it remotely using TeamViewer, using just a PIN.

https://www.theregister.com/2025/08/01/microsoft_recall_captures_credit_card_info/

I still use Recall on my development laptop, and actually use the feature quite a lot through testing Recall... and yet, I've started to get regular engagement prompts to use it lately.

To me this strongly suggests people aren't actually using it in the wild as MS are trying to juice numbers via nudge prompts.

On a separate note I also got prompted to change my default browser to Edge (I use Vivaldi) and my search engine to Bing when switching on my laptop today 🤦

Microsoft are upselling security controls for Microsoft Recall, which allow orgs to limit what it records specifically - if the org pay for Microsoft Purview.

I’ve had a look at how this works under the hood, it is using undocumented features in Recall. https://learn.microsoft.com/en-us/purview/dlp-recall-get-started

Microsoft is reviewing its Copilot+ integrations, and is saying internally that Microsoft Recall has failed.

https://www.windowscentral.com/microsoft/windows-11/microsoft-is-reevaluating-its-ai-efforts-on-windows-11-plans-to-reduce-copilot-integrations-and-evolve-recall

So @xaitax has cracked Microsoft Recall, he's got access to the encrypted database and has automated dumping of screenshots and all text from screenshots.

I've looked at most recent Recall and yep, you can just read the database as a user process. The database also contains all manner of fields which aren't publicly disclosed for tracking the user's activity.

No AV or EDR alerts triggered, world's #1 in infostealer 😅

* you can just read it in plain text

@Pibert @GossiTheDog @xaitax linux has a lot of developers indeed. More people fix security vulnerabilities in linux than in windows.

More programs work on windows, but windows does most things poorly.

Something interesting happened in the software of windows once, not sure when...

Supposedly at one point it was changed from YOURPC to THISPC.

Like before windows 8.1, I forget when.

But that is a sign that enshittification was coming lol.

@skedarwarrior @Pibert @GossiTheDog @xaitax

It was Windows 95 that had the first onboard ads API. The "developers developers developers" chant was from Ballmer promoting the .net framework at launch in 2000 or so.

@Sempf @skedarwarrior @GossiTheDog @xaitax

It has like optimized drivers and it’s based of Ubuntu. It’s a good choice for casual users and gaming users + it has Linux kernel (good for programming hehe)

The only exception are Riot Games with Ring Zero “anti-cheats” that looks at the kernel what’s happening at your computer and they need windows and secure boot.

But I think all the other games are ok.

@Pibert @Sempf @GossiTheDog @xaitax Why corporations are allowed to put anticheat in the kernel of people's computer and not do it serverside is beyond me.

And I know they do it this way cause money, but eff that reason to hell and back!

That's like putting a rootkit at the base of your operating system. Stupid by design.

@skedarwarrior @Sempf @GossiTheDog @xaitax

I don’t play these games because of this and I find this disgusting.

But the people use discord that “knows what you’re playing and what you’re using the computer for”…

I find discord as worst as riot. I only use a sandboxed client in Linux, never in windows

@skedarwarrior @Sempf @GossiTheDog @xaitax

what type of app knows what you’re playing and knows what “music on Spotify you’re using?”

This falls in the same category as spywares