Microsoft's open backdoors in Windows, a risky approach to privacy, lambasted by AdGuard: "Trusting Microsoft's good intentions indefinitely for privacy isn't a robust strategy"
Microsoft's latest AI feature, Windows Recall, has been causing a stir among users, particularly those with Copilot+ PCs. The tool, which captures screenshots of user activity every five seconds, has raised concerns about privacy and security due to its screenshot capture behavior.
Windows Recall, launched as part of the 24H2 release, runs on high-end Copilot+ PCs with local-only storage and encryption measures like TPM and VBS Enclave isolation. The feature was initially met with controversy in 2024 when it was found capturing sensitive personal information, leading to a pause in its rollout.
Microsoft reintroduced Recall in preview mode with a "Filter sensitive information" setting enabled by default. However, independent testing revealed that this filter still fails in many cases, allowing sensitive data to be captured and stored locally.
Privacy advocates remain skeptical, emphasising that creating a persistent, OS-level log of nearly all user activity could become a "potential treasure trove for thieves," especially if a device is compromised.
In response to these concerns, some software vendors have taken protective steps. The Brave browser, for instance, blocks Recall from capturing screenshots of its tabs by default, treating all browser windows as private, to prevent sensitive browsing data from being captured. Signal has also implemented measures to safeguard against Recall capturing its app windows.
Microsoft requires explicit user opt-in to enable Recall and restricts the feature to Copilot+ PCs that meet enhanced security standards. However, the overall trust deficit remains significant.
AdGuard, an advanced ad blocker, has shipped a new update to protect users against user tracking. This update includes a new feature called Disable Windows Recall, adding to the growing list of third-party mitigations aimed at safeguarding user privacy.
In summary, while Microsoft has taken steps to improve the privacy and security of Windows Recall—such as opt-in activation, encryption, filtering of sensitive info, and integration with secured hardware—independent tests show these measures are not yet foolproof. This ongoing risk leads to concerns about potential abuse or data leakage on systems running Recall, prompting third-party mitigations like Brave’s default blocking and continued scrutiny by security experts.
This feature is relevant for those using the latest Microsoft Copilot PCs. Microsoft's Copilot+ PCs are being promoted as the go-to device for upgrading to Windows 11, and concerns about privacy and security may influence user decisions.
[1] The Register [2] XDA Developers [3] TechCrunch [4] Ars Technica [5] Wired
- The screenshot-capturing tool Windows Recall, launched on high-end Copilot+ PCs and requiring explicit user opt-in, remains a topic of sensitive discussions, with concerns about data privacy and security persisting.
- The controversial AI feature Windows Recall, part of the 24H2 release, employs encryption measures like TPM and VBS Enclave isolation but has been shown to still capture sensitive data in certain instances.
- As Microsoft works to enhance the privacy and security features of Windows Recall, third-party software vendors like Brave and Signal have implemented mitigations to protect user data, treating their browser and app windows as private by default.
- Adopting a proactive stance, AdGuard has released an update with the Disable Windows Recall feature, aiming to further protect users against user tracking and potential data leakage.
- The ongoing debate surrounding Windows Recall's privacy implications is particularly relevant for those considering the upgrade to Windows 11, as Microsoft Copilot+ PCs are being positioned as the preferred devices for the new operating system.
- Evidently, Microsoft continues to address initial concerns around Windows Recall, introducing measures such as the "Filter sensitive information" setting and restricting the feature to Copilot+ PCs with enhanced security.
- Despite various attempts to improve the tool's privacy and security, the fallibility of certain features, such as the filter for sensitive information, still leaves room for concern and has prompted additional scrutiny from technology publications like The Register, XDA Developers, TechCrunch, Ars Technica, and Wired.
