Microsoft has recently announced that participants in the Windows Insider Program with a Qualcomm Snapdragon-powered Copilot+ PC can now test out Recall, a controversial snapshot-taking, AI-powered feature that received a lot of criticism earlier this year. The company took the feedback into consideration and made changes to address the concerns raised by users and experts.
Initially, Microsoft faced backlash for the security and privacy implications of Recall. In response, the company decided to make the feature opt-in instead of being enabled by default. They also enhanced the protection of data stored in the snapshots by encrypting them and securing the encryption keys through the Trusted Platform Module, which is linked to a user’s Windows Hello Enhanced Sign-in Security identity.
In addition to these changes, Microsoft implemented rate-limiting and anti-hammering measures to prevent brute-force attacks on the stored data by Recall. They also ensured that Recall does not save information from private browsing sessions and enabled sensitive content filtering by default.
After making these adjustments, Microsoft has now invited Windows Insiders to try out Recall. In order to use the feature, users must opt-in to saving snapshots and enable BitLocker and Secure Boot. They also need to enroll in Windows Hello for facial recognition, fingerprint scanning, or PIN for signing in.
Users have the ability to control the taking of snapshots, exclude specific apps, websites, and sensitive information from the snapshots, and delete the snapshots through Recall-specific settings. Microsoft has also taken steps to address the concerns raised by security researchers and privacy advocates.
Recall can now detect sensitive information such as credit card details, passwords, and personal identification numbers and will not save or store snapshots containing this data. The saved snapshots remain on the user’s PC and will not be used by Microsoft for training purposes. Microsoft also reassured that they will not have access to the keys needed to view the encrypted data.
For PCs managed by IT administrators in work or school settings and Enterprise versions of Windows 11, Recall will be disabled by default. Employees will have to choose to opt-in to saving snapshots and enroll in Windows Hello for their snapshots to be saved. Organizations have full control over the availability of Recall and can prevent its use altogether or restrict the saving of specific apps or sites.
For devices not managed by an organization or school, Recall will be available by default, and users can opt-in to saving snapshots. They also have the option to remove or turn off the feature through the Windows features settings.
While Windows Insiders are encouraged to test Recall and report any issues to Microsoft, security researchers are expected to look for any security vulnerabilities in the feature. Microsoft has stated that Recall is eligible for bug bounty as part of the Insider program, with a potential payout limit of $20,000.
There is currently no specific timeline for when Recall will be made available to the general public. Microsoft continues to work on refining the feature based on feedback and testing from Insiders.