“It will be off by default unless you actively turn it on,” Pavan Davulli, head of Windows and Surface devices at Microsoft, wrote in a blog post on Friday.
Microsoft has recently been balancing competing interests as it tries to keep up with the competition by incorporating new generative AI tools into its products. While the market is rapidly evolving, user privacy and security are under intense scrutiny. A U.S. government investigative committee recently criticized Microsoft for its response to China's unauthorized access to the email accounts of U.S. government officials.
Microsoft has already added a conversational chatbot, Copilot, to Windows in a similar way to OpenAI's popular ChatGPT. Both ChatGPT and Copilot rely on servers in the cloud to perform the necessary calculations and return responses to your PC. Recall differs in that it keeps data on the user's computer and doesn't need to access additional computing power over the internet.
Microsoft CEO Satya Nadella has told employees to make security a top priority and announced changes to the company's security measures in response to the US government report.
After Microsoft announced “Recall,” a feature that allows users to search logs of past activity on a PC, industry experts began to question the possibility of hackers obtaining user information.
Security experts have released software called Total Recall that displays the data collected by Recall.
“Windows Recall stores everything locally in an unencrypted SQLite database, and screenshots are simply saved to a folder on your PC,” reads Total Recall's description on GitHub. They expressed concern that attackers could develop tools to look for usernames and passwords contained in Recall screenshots.
In addition to requiring users to manually turn on Recall when the Copilot+ PC launches on June 18, Microsoft plans to add additional security protections to Recall: The search index database will be encrypted, Microsoft said.
“Enrollment in Windows Hello is required to enable Recall,” Davuluri wrote, “plus proof of presence is required to view your timeline and search in Recall.”
Windows Hello allows users to verify their identity by entering a PIN number, showing their face to the PC camera, or providing a fingerprint.
“Overall, I think having the choice to opt in or not on your home systems will prevent a lot of people from having security issues in the future,” Kevin Beaumont, a former Microsoft cybersecurity analyst who criticized the recall's initial implementation, said in a Friday post on X. “It should never have been enabled by default.”
