After criticism of the recall function, Microsoft announces new security and data protection measures.

The Windows recall feature for Copilot+ PCs has been hit hard lately. While this initially seemed like a useful feature, critics were quick to voice their concerns. With the Recall feature, Microsoft saves screenshots of everything you do on your PC. You could then easily access these with the help of AI. Handy when you need to find something, but where is everything stored?

The criticism led to Microsoft recalling the recall function. In the meantime, Microsoft took its time tinkering with Recall’s privacy and security measures. The company now explains in a blog post how it has improved security.

Privacy and security measures

After heavy criticism of Microsoft’s Recall function, the company announces new security and data protection measures for the Recall function. A blog post describes the measures that define Recall’s data protection and security.

First of all, Microsoft emphasizes that the user is always in control. When you install Recall, you as a user will be given a clear option to choose whether you want Recall to save the screenshots or not. Additionally, users can also completely remove Recall via the optional feature settings in Windows.

If you as a user choose to use this feature, Microsoft ensures that sensitive data in Recall is always encrypted. “The encryption keys are protected by the Trusted Platform Module (TPM) associated with a user’s Windows Hello Enhanced Sign-in Security identity and can only be used by operations in a secure environment that uses a virtualization-based security enclave (VBS Enclave ) used ),” said David Weston, vice president of enterprise and operating system security at Microsoft.

Additionally, the recall services that process screenshots and related data reside in a secure VBS enclave. This means that the only information leaving the VBS enclave is that which the user requests when actively using Recall.

Caution

Among other things, Microsoft states that Recall was evaluated by a third party that conducted a penetration test and security design review. Due to the huge storm of criticism directed at Recall, Microsoft is trying to roll out the new rollout particularly carefully. It is not yet clear why these measures were not taken from the start.