Microsoft has provided an update on Windows 11’s Recall feature – which has been on ice for some time now, since its revelation caused a massive stir due to security and privacy worries – and when it plans to forge ahead with the feature and bring it to Copilot+ PCs.
As the BBC reports, Microsoft said in a statement that the plan is to launch Recall on CoPilot+ laptops in November, with a bunch of measures being implemented to ensure the feature is secure enough detailed in a separate blog post.
So, what are these measures designed to placate the critics of Recall – a capability which is a supercharged AI-powered search in Windows 11 that leverages regular screenshots (‘snapshots’ as Microsoft calls them) of the activity on your PC – as it was originally envisioned?
One of the key changes is that Recall will be strictly opt-in, as Microsoft had told us before, as opposed to the default-on approach that was taken when the feature was first unveiled.
Microsoft notes: “During the set-up experience for Copilot+ PCs, users are given a clear option whether to opt-in to saving snapshots using Recall. If a user doesn’t proactively choose to turn it on, it will be off, and snapshots will not be taken or saved.”
Also, as Microsoft previously told us, snapshots – and other Recall-related data – will be fully encrypted, and Windows Hello authentication will be a requirement to use the feature. In other words, you’ll need to sign in via Hello to ensure that it’s you actually using Recall (and not someone else on your PC).
Furthermore, Recall will use a secure environment called a Virtualization-based Security Enclave, or VBS Enclave, which is a fully secure virtual machine isolated from the Windows 11 system, that only the user can access with a decryption key (provided with that Windows Hello sign-in).
David Weston, who wrote Microsoft’s blog post and is VP of Enterprise and OS Security, explained to Windows Central: “All of the sensitive Recall processes, so screenshots, screenshot processing, vector database, are now in a VBS Enclave. We basically took Recall and put it in a virtual machine [VM], so even administrative users are not able to interact in that VM or run any code or see any data.”
For that matter, Microsoft can’t get in to look at your Recall data, either. And as the software giant has made clear before, all this data is kept locally on your machine – none of it is sent to the cloud (that could be a big security worry if it was). This is why Recall is a Copilot+ PC exclusive, by the way – because it needs a powerful NPU for acceleration and local processing for Recall to work responsively enough (as the cloud can’t be leveraged to speed up the AI grunt work).
Finally, Microsoft combats a previous concern about Recall taking screenshots of, for example, your online banking site and perhaps sensitive financial info – the feature now filters out things like passwords, credit card numbers and so on.
Other privacy tightening measures include the ability to exclude specific apps or websites from ever having snapshots taken by Recall (and we should note that private browsing sessions, such as Chrome’s Incognito mode, are never subject to being screenshotted – at least in supported web browsers).
An icon will appear in the taskbar when a Recall snapshot is being saved, incidentally, and it’ll be easy to pause these screenshots from there if you wish to do so.
Analysis: Recalled from the bench – but with a lot to prove
Microsoft has basically taken Recall back to the drawing board on the security and privacy fronts over the past few months, and in broad terms, the results deserve a thumbs-up. (Although let’s be honest, elements like the tight encryption should have been in place to begin with – and it’s a bit frightening that they weren’t).
If you’re still concerned about Recall despite these measures, you simply don’t have to enable it. And with it being off by default in a clear manner now, there’s no danger of less tech-savvy folks ending up using the feature by accident, without realizing what it is.
The path Recall is on now is that it’s returning to testing in October, so very soon, and with the release coming to Copilot+ PCs in November, it’s on something of a fast track to arrive with the computing public – well, those who’ve invested in a Copilot+ laptop anyway. We’re sure that for those folks, Recall will still be marked as in ‘preview’ and it’s debatable whether you should be taking the plunge with an ability like this when it’s not quite fully finished.
Of course, we’re getting a bit ahead of ourselves here – the next step is for Recall to arrive in Windows 11 test builds, and see what Windows Insiders make of it. If problems crop up in those preview builds, we may yet see Recall delayed for release to Copilot+ PCs.
Microsoft is talking a much bigger security game for Recall here, without a doubt, and let’s hope there are no setbacks or mistakes in terms of actually implementing all of this. Given how the initial incarnation of Recall was put together – with a worrying lack of attention to detail – it’s easy to be cynical here, but presumably Microsoft is not going to fall into this trap again.