At the Copilot+ PC event, Microsoft announced the much-hyped Recall feature that takes screenshots of your screen and performs AI analysis in the background. You can later find things and activities using semantic search. But after just a few days, a security researcher discovered numerous security holes in Recall's implementation and called the feature a privacy nightmare.
Bad news for Windows Revoke & How to disable it
The main problem was that once the user logged in, the vector index remained unencrypted and any app or script could access it. Apart from that, the rollback feature was enabled by default, and there was no option to disable it during the introductory setup.
Finally, after a huge uproar, Microsoft has responded. In a blog post, Pavan Davuluri, Microsoft's VP of Windows and Devices, confirmed that users could enable or disable Recall during the initial setup. This means that Recall is now opt-in by default which is good.
Next, Microsoft adds an extra layer of security to protect Recall's vector index. The local database will now remain encrypted and will only be decrypted when the user authenticates with Windows Hello. Microsoft uses Windows Hello Enhanced Sign-in Security (ESS) for "just in time" decryption.
