Windows 11's Recall feature is on by default on Copilot+ PCs
- Reference: 1717438507
- News link: https://www.theregister.co.uk/2024/06/03/windows_11_recall_on_default/
- Source link:
Over the weekend, The Verge's Tom Warren [1]posted screenshots showing Microsoft's latest Out-of-Box Experience (OOBE), in which the Recall feature can't be turned off unless the user opens Settings after completing setup.
The feature remains a preview, and the first Copilot+ PCs that will support it are not due to hit the market until [2]June 18 – although users have shown it [3]running on less exotic hardware . This date means there is still time for changes to be made, particularly in light of the controversy surrounding Recall, described by one cybersecurity researcher as "a keylogger" built into Windows.
[4]
Recall takes regular snapshots of a user's Windows activity, which it stores locally. The user can then step back and find what they were doing in the days, weeks, or months previously. The magic of AI is employed to help a user search for what they want and suggest actions.
[5]
[6]
It's also a potential [7]privacy nightmare . Despite updates to its documentation to include browsers other than Edge in its list of "supported browsers" able to filter out specific websites and private browsing activity, Microsoft support [8]still notes :
Recall does not perform content moderation. It will not hide information such as passwords or financial account numbers. That data may be in snapshots that are stored on your device, especially when sites do not follow standard internet protocols like cloaking password entry.
Word is [9]circulating that Microsoft might tweak the OOBE to stop the feature from being enabled by default. Steven Sinofsky, who played a part in bringing Windows 8 to the world, [10]noted that the default was "the least problematic part of the feature."
[11]Microsoft's Recall preview doesn't need a Copilot+ PC to run
[12]VBScript nudged nearer to the grave with next big Windows 11 update
[13]Giving Windows total recall of everything a user does is a privacy minefield
[14]Microsoft smartens up Edge for Business with screenshot blocking, logo branding, more
Sinofsky also [15]observed : "Features that are the future of computing should be on by default and turning things off should not be part of any routine or default customer experience. If it can't be on then it isn't a platform feature."
As far as Microsoft is concerned, AI is the future of computing. It has to be since the company needs to show some return on its investment, and Windows 11 has yet to set the market alight.
If Recall were something consumers had to opt into rather than opt out of, it would be easy to imagine the feature quietly fading away. Enterprise administrators can already disable snapshot saving via group or device management policy and are unlikely to re-enable it until regulators have finished [16]poking around Microsoft's plans.
[17]
With AI on the roadmap for the vast majority of Microsoft's products, making Recall an option that is not enabled by default would call into question its commitment to the strategy. Even if many privacy and security experts would welcome the backtracking. ®
Get our [18]Tech Resources
[1] https://x.com/tomwarren/status/1796681578984182066
[2] https://blogs.microsoft.com/blog/2024/05/20/introducing-copilot-pcs/
[3] https://www.theregister.com/2024/05/28/microsofts_recall_preview_on_non_ai_pc/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Zl48-8m1Pxh4-YSwxomyRAAAAEA&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Zl48-8m1Pxh4-YSwxomyRAAAAEA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Zl48-8m1Pxh4-YSwxomyRAAAAEA&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://www.theregister.com/2024/05/22/windows_recall/
[8] https://support.microsoft.com/en-gb/windows/privacy-and-control-over-your-recall-experience-d404f672-7647-41e5-886c-a3c59680af15
[9] https://x.com/zacbowden/status/1796700451187929096
[10] https://x.com/stevesi/status/1796984605528166514
[11] https://www.theregister.com/2024/05/28/microsofts_recall_preview_on_non_ai_pc/
[12] https://www.theregister.com/2024/05/23/windows_11_24h2_vbscript/
[13] https://www.theregister.com/2024/05/22/windows_recall/
[14] https://www.theregister.com/2024/05/21/microsoft_edge_business/
[15] https://x.com/stevesi/status/1797006841823858821
[16] https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2024/05/statement-in-response-to-microsoft-recall-feature/
[17] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Zl48-8m1Pxh4-YSwxomyRAAAAEA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[18] https://whitepapers.theregister.com/
Why not turn on the camera and microphone as well in an undetectable manner? Then these inputs can be AI-processed and detect if the correct owner is operating the device and warn of license violations if the wrong person is operating the device.
The microphone is paramount to prevent the most heinous crimes. The brand new AI will listen for tell-tale signs of seriously problematic behaviours in the vicinity of the device and alerts the proper authorities when improperly licensed music, games or videos are detected.
Sinofsky noted that the default was "the least problematic part of the feature."
Proving the guy who was in charge of Windows 8 hasn't got any idea. Imagine you're business inside UK or the EU and each of your PCs starts recording data on customers which your users accessed during the course of their work using Citrix or RDP to avoid data getting onto the local PC.
Now you've suddenly got data on the local PC. You don't know how Copilot's copy is stored, modified, or deleted so you can't deal with subject access requests, you don't know how much of it gets slurped by Microsoft, and you're suddenly responsible for it all.
"I It will not hide information such as passwords or financial account numbers"
Forget having it turned off. I'd want the code stripped out completely and the ability to confirm the same..
Nasty little fuckers
Sueball
Incoming in 3, 2, ............
On by default
"Features that are the future of computing should be on by default and turning things off should not be part of any routine or default customer experience. If it can't be on then it isn't a platform feature."
The choice of which features are on should be made by the owner of the computer, and that is the person who paid for it, not the OS vendor. Since real people vary, the defaults should be conservative.
OS vendors who fail to grasp this simple point should kindly FOAD.
Re: On by default
I agree with you, but I also take his point. "features that are the future computing" can be interpreted as "features that most people will want turned on". Obviously such things should typically be enabled by default.
Corollary: this is not the future of computing.
I had no intention
of ever using Windows ever again. Now I'll doubly never use it again!
Re: I had no intention
You and me both.
But the problem is the dozens of people handling my data - banks, councils, insurance etc - who _are_ using it, with all the potential issues listed upthread.
Re: I had no intention
Very good point.
Re: I had no intention
I don't think many shills for Recall have thought about the rank amateurs in councils, insurance etc., let loose with Recall (aka MS Keylogger supreme). Asbestos Umbrellas to the ready!
It begs the question
Why?
Why does m$ want to take screenshots of your desktop every 2 minutes(or whenever), it cant be for the user's benefit since creating and saving the screenshot will impact on your computer's performance.
So only reasons I can see is so m$ can see what programs you are using so they can tell if you're using a pirated copy, and so that they can issue commands to your pc to search said screenshots for content so they can then sell advertising aimed at you. oh and law enforcement
The telling feature is if it is only available on home versions not corperate ones... as getting their ass sued off by companies, countries, and trade blocs is not in the game plan (unless they have some nice juicy blackmail from someone's home computer thats just had recall reactivated by an 'update')
"Microsoft's latest Out-of-Box Experience (OOBE)"
More like "can stay in the box for all I care" experience.
Since I even transitioned my gaming platform to Linux (thanks steam and proton!), I literally have no reason left to have this stuff in my house :-)
Re: "Microsoft's latest Out-of-Box Experience (OOBE)"
Out-of-Box Experience (OOBE)
Out-of-Brains Experience
FTFY
An absolute shitshow
When Microsoft said it was encrypted, they meant by BitLocker (i.e. transparent to the software running at the time, including malware).
The data is held in unencrypted in SQLite databases in AppData.
[1]Stealing everything you’ve ever typed or viewed on your own Windows PC is now possible with two lines of code — inside the Copilot+ Recall disaster.
[1] https://doublepulsar.com/recall-stealing-everything-youve-ever-typed-or-viewed-on-your-own-windows-pc-is-now-possible-da3e12e9465e
Re: An absolute shitshow
> The data is held in unencrypted in SQLite databases in AppData
Damn shame it is impossible to add encryption to an SQLite database - oh, wait a moment:
[1]https://learn.microsoft.com/en-us/dotnet/standard/data/sqlite/encryption?tabs=netcore-cli "SQLite doesn't support encrypting database files by default. Instead, you need to use a modified version of SQLite like SEE, SQLCipher, SQLiteCrypt, or wxSQLite3. This article demonstrates using an unsupported, open-source build of SQLCipher, but the information also applies to other solutions since they generally follow the same pattern."
Perhaps MS devs aren't allowed to "waste their time" reading the MS "learn" website?
[1] https://learn.microsoft.com/en-us/dotnet/standard/data/sqlite/encryption?tabs=netcore-cli
Turning things off
> turning things off should not be part of any routine or default customer experience.
So, anybody else here got a list of things that are routinely hunted down and turned off whenever they install Windows?[1] Either by hand or by IT supplying their own ready-to-go image.
Frankly, I'd think turning things off ought to a routine for pretty much everyone - it is daft[2] to believe that every "amazing new feature" is worth the resources to *every* user.
And as for believing *your* every feature is "the future of computing" that everyone ought to use...
[1] actually, any OS - I find that even Linux installs are best followed by a routine of removing stuff that gets added by default, as well as the obvious "install other stuff you do like". And, yes, I do know about creating one's own distro respins: following the routine isn't arduous, just tedious: it isn't a big enough issue to warrant the need for a respin, let alone a Corner Linux distro.
[2] nicest way to frame it; other descriptions, using the word "pathological", are available
My hardware is not compatible
Thank $Deity for that . . .