Where Microsoft Went Wrong And How To Disable It For Now

Following backlash, Microsoft announced on June 7, 2024, that Recall will be disabled by default, which means users will need to activate it during the opt-in setup process for saving snapshots. Additionally, Recall will be secured behind a Windows Hello log-in, which means the activity log won’t be accessible without the right face, fingerprint, or PIN to unlock the machine. “In addition, proof of presence is also required to view your timeline and search in Recall,” assures Microsoft.

Beyond that, Recall is putting faith in the security measures deployed by other companies on their respective websites and apps. “It will not hide information such as passwords or financial account numbers. That data may be in snapshots that are stored on your device, especially when sites do not follow standard internet protocols like cloaking password entry,” says Microsoft.

So, for example, if a banking website or app doesn’t hide credentials behind dots or asterisks during the sign-in process, a snapshot of that sensitive information would be saved locally on a computer running Recall. Adolf Streda, Malware Researcher at Avast, tells SlashGear that to access that kind of granular data, hackers would usually have to deploy sophisticated tools like keyloggers and screen grabbers. Recall snapshots seemingly turn into a wholesale data market, and open new avenues for sextortion scams, as well. “All that remains for them is to figure out how to access Recall’s storage or scam you into providing them access to it,” notes Streda.