This time last year, Microsoft rushed Windows Recall
into public testing, allowing AI PCs, whatever those are,
to record, catalog, and even revisit all user interactions.
You know, in case you forgot how to open up your browser history or scroll up in a chat window.
And to say that that rollout went poorly would be a gross understatement.
I really don't know what they were expecting though. I mean, days prior, CEO Satya Nadella called for Microsoft
to prioritize security above all else.
And then they immediately start pushing this app that not only records everything that appears
on the screen of your computer, but also utilizes the AI capabilities of said computer
to turn everything it sees into an easily searchable database.
Now, Microsoft claim was that all of that's fine
and that Recall is totally secure. Unfortunately, that held up for about as long as it took
for someone to download the preview and then track down the folder that it was writing to,
at which point the entire internet lost its collective mind
over how absolutely not secure it actually was.
Now, it was about that time that we wrote this video,
tearing the whole thing apart. But then as we were set to film it,
Microsoft announced that they would postpone Recall in response to the community's concerns.
And here we are a year later and Recalls back, baby.
But have all the problems really been addressed? I mean, was it even that bad before it got delayed?
Am I ever gonna segue to our sponsor?
Before we go any further, what is Recall again?
And what was everyone so upset about last time? I can't seem to recall, records everything
that appears on the screen of your computer. Oh, that's it.
Windows Recall takes screenshots, they call them snapshots,
of whatever it is that you're doing on your PC every few seconds and then feeds them
through AI-assisted optical text recognition and image analysis, then stores it all
in a local database for your convenience.
And they only need 10% of your hard drive space to do it?
Outstanding. The idea then is that you can fire up Recall
and ask it things like, hey, what was that Korean restaurant
that Alice mentioned the other day? And then without you needing to remember
whether it was an email, a Teams message, or a random calendar invite, Recall will crap out
a snapshot that has the result for you. You can even copy and paste text and images
from within those saved snapshots to easily search or share them, which I have to admit,
does sound kind of nifty. And supposedly it is a lot more secure now,
but I am not gonna take Microsoft's word for it.
Not when I can compare them both side by side.
You see, this machine is running new Recall.
You don't need anything super special to use it, just a co-pilot plus ready PC
that meets the secured core standard. Also a couple of other things
that any such machine would likely have. But that wasn't always the case.
See, the original Windows Recall was only officially available on laptops
with Snapdragon X Elite and X Plus processors,
which unfortunately we didn't have access to at the time.
But thanks to a legend by the name of Albuquer,
we were able to get it up and running on this old HP Elite Folio,
which conveniently has been powered down with its radios off going,
la la la la la, I can't even use Windows update. Since before Microsoft delayed the launch,
allowing us to compare old Recall to new Recall.
Let's see exactly what's different. Well, for starters, Recall is now hopped in
instead of being on by default. That is a very big improvement.
But with that said, Microsoft has a long, proud history of using dark patterns
to trick you into changing default system settings or even just changing them on their own.
So I'm gonna believe that this is permanent when I see it.
What else has changed? Well, Microsoft now says that Recall is secure
with the data encrypted, protected by BitLocker
and requiring Windows Hello authentication.
Of course they said it was secure a year ago too though, so let's make our way through this helpful FAQ from 2024
and compare what they said then and how it behaves on both of our machines.
Let's see here. Recall snapshots are kept on the local hard disk.
Okay, that was true before. In fact, they're right here in this core AI platform folder
under the user's local app data and okay.
Yep, that looks like it's still true. How about data is protected
using disk encryption and BitLocker?
Well, that was at least partly true back in 2024,
but it was also pretty misleading.
See, BitLocker would protect your data, including your Recall snapshots.
If somebody stole your device, but if you were logged in
and you just stepped away for a moment, then those snapshots would be protected
only by Windows permissions. And I don't know all this for sure,
but I think most lead hacksaws are pretty good
at clicking continue. All right, let's see what else we've got here.
We've got show file extensions on, by the way.
So I'm gonna go it on a limb and guess that this .db file here is the database.
And if we look at the file header in a hex editor, it looks like it's just a SQLite database.
So we can use any of the dozens of free tools out there to interact with that.
And there it is.
Look at all that plain text.
Oh my God. I read about this back then,
but I didn't actually look at it for my... It's just plain text.
Yeah. That's wild. And if I stretch my detective skills
just a little bit further, I would guess that that image store folder
is full of images.
Oh no, they're not images. They're unknown files.
I can't surely do anything about this.
Open with hex editor.
And would you look at that? J-F-I-F, which means...
Oh my God.
Boop. Watch this. I accidentally figured this out. If I click and drag,
it previews it. Now all I need to do is open it and...
Wow. I hacked it.
Oh man, that's a yikes. So that's it.
That's what Jordan was doing on his computer at some time.
All the metadata is just in there. Okay, timestamp 2023, December 4th,
because this computer is set to 2024. So that's, yeah, that probably is...
Yeah, that's about right there. When we were looking at it, pathetic. Let's look at the new one.
This database file right there, AES encrypted.
Also, where we had plain text before. Now we have not so plain text.
Scrambled, he scrambled. That's what we wanna see. Okay, what about the image store folder though?
It's empty. It's a different folder now. A sim store. Okay, all right.
Cleverly hid them. Yeah. This, probably a JPEG.
Let's try the same trick, okay? No thumbnail preview.
And if we try to open it, no dice.
Okay. Everything seems to be actually encrypted this time.
So I gotta give Microsoft a point on our scoreboard
for fixing that. But then I've also gotta take a point away
for lying about it in the first place. So then, okay, old recall minus one point,
new recall zero points. Let's have a look at our next claim here.
Microsoft won't view your recall data or make it available for targeted advertisements.
The skeptic in me wants to add yet to the end of that statement.
But I would say that it was probably true when they were first testing
and is probably still true at the time we're filming this. Though, once again, I feel it's a matter of time
before they quietly change this and then hope that no one will notice.
As for this next one, this is where things get objectively really bad.
Snapshots are only available to the person whose profile was used to sign into the device.
If two people share a device, they will not be able to access each other's snapshots.
Okay. When we tested this back in 2024,
that was a straight up lie and potentially a really dangerous one.
By simply creating an administrator account on the same machine,
I could easily navigate to any other user's app data folder
and then check out anything that they had ever done on the computer.
Now, I hate to even have to bring up such horrible scenarios,
but guys, imagine this in the case of a journalist
in an oppressive regime whose device was seized by force or for a victim of domestic abuse
who was trying to find help online. As recall was implemented in 2024,
a bad actor could have seen everything their victim had done on the computer
and that was enabled by default.
Fortunately, that seems to have changed now.
Okay, stop recording OBS. You'll have to take my word for it.
I'm signing out. I'm signing in as other user. According to my platform.
Okay, P continue, okay. So all this still works,
but because it's all encrypted,
we can't view it. So with the shift to opt in,
the addition of Windows Hello authentication and things seemingly actually being encrypted this time,
it is a little less horrifying, but I still don't think Microsoft has gone far enough
to educate users on the dangers of this feature.
See, people do still share accounts in 2025
and I guarantee you that most of your normie friends
are not gonna pay attention to all the little icons
that are down in their system tray. So saying, oh yeah, that little blue squiggle,
that means you're getting surveilled. That doesn't really cut it for me.
Also, the old FAQ claimed that recall
couldn't be accessed by other applications or services,
but while it is possible that other Microsoft apps
didn't access the stuff back in 24, within days of the preview launch,
there were multiple tools that could extract recall data,
both locally and remotely. So that particular claim feels at the very least
like a lie by omission. Take a look at Total Recall, for example.
The media called this a hacker tool, but what it really is is a few dozen lines of Python
that an AI assistant could probably crap out for you in about 30 seconds.
Total Recall copied the images and the database folder,
made a handy little report of all your window titles, and if you scrolled through it,
led to the discovery of yet another lie from our pals at Microsoft.
Microsoft claimed back then that recall didn't record incognito Windows in most common browsers,
Edge, Firefox, Opera, and Google Chrome, but plain as day, here's a window title from Fark.com,
which we only visited in a brief incognito session.
Anyway, back to other apps being blocked from recall data,
at least on the new one because they're encrypted, something like Total Recall couldn't be just
randomly created by a third party, but it's also clear that Microsoft isn't even pretending
that their own apps can't access the data anymore.
On our new machine, the new click-to-do co-pilot feature
requires recall to be enabled and is, by all appearances,
a other app or service, so lie then,
and I guess it's gone from the FAQ now, so no longer a lie, but certainly a change.
Anywho, the 2025 flavor of Recall adds a toggle
that will filter sensitive information automatically, which seems to be enabled by default, which is something,
but it relies on the AI recognizing
that any information that you have on-screen is sensitive, and I really don't know if I would trust this guy
to determine if my on-screen data is sensitive or not,
at least not yet. So what's the bottom line here?
Well, I gotta give Microsoft some credit.
They could have just powered forward and released Recall in its primitive state,
but instead, they listened to the outrage of the tech community
and are making what looks like a serious effort to address many of the issues
with their original Recall launch.
But with that said, I still oppose the existence of this feature
because of what it means for our collective privacy, because here's the thing,
even if you don't turn on Recall yourself,
how do you know that everyone you're emailing or maybe messaging in signal hasn't linked their PC
that has Recall turned on? Now, Signal has announced a new, enabled-by-default setting
to prevent screen capture of signal chats on Windows, but that doesn't cover you for any other chat
and it doesn't prevent someone from turning capture on in signal
if, say, grandma likes to use Recall to help her remember things.
And I mean, yeah, that is pretty useful for her,
but should baby pictures and a family WhatsApp
really be slurped into a Microsoft-managed database?
And yeah, I know, I know, I know. It's stored locally and it's encrypted,
but data is only local until it's been stolen
and it's only encrypted until some quantum bulls*** breaks that encryption.
The very existence of Recall makes Windows a less secure platform
because in the very near future, all compatible Windows 11 machines
are going to have a built-in tool that gathers and catalogs an unprecedented wealth of information
about Windows users and then stores it in a convenient place
for attackers to target. So if they're looking for some confidential information,
the heavy lifting is done for them.
What are we gonna have to do? Go back to writing letters? I mean, hey, at least we sell the scribe driver pen
on LTTstore.com. You can use that to write a letter,
although then there's definitely a physical record
of what you wrote and the point is, I think Andrew Cunningham said it best
on Ars Technica last year. Windows Recall demands an extraordinary level of trust
that Microsoft hasn't earned. What a great turn of phrase.
And what a great opportunity to tell you about our sponsor.
If you guys enjoyed this video, maybe you'd like some mini rants
about small problems that make tech big awful.