This time last year, Microsoft rushed Windows recall into public testing,
allowing AI PCs, whatever those are, to
record, catalog, and even revisit all
user interactions. You know, in case you forgot how to open up your browser
history or scroll up in a chat window. And to say that that rollout went poorly
would be a gross understatement. I really don't know what they were
expecting, though. I mean, days prior, CEO Satin Nadella called for Microsoft
to prioritize security above all else.
And then they immediately start pushing this app that not only records
everything that appears on the screen of your computer, but also utilizes the AI
capabilities of said computer to turn everything it sees into an easily
searchable database. Now, Microsoft
claim was that all of that's fine and that recall is totally secure.
Unfortunately, that held up for about as long as it took for someone to download
the preview and then track down the folder that it was writing to, at which
point the entire internet lost its collective mind over how absolutely not
secure it actually was. Now, it was
about that time that we wrote this video, tearing the whole thing apart.
But then, as we were set to film it, Microsoft announced that they would
postpone recall in response to the community's concerns. And here we are a
year later and recall's back, baby. But
have all the problems really been addressed? I mean, was it even that bad
before it got delayed? Am I ever going to segue to our sponsor, Delete Me? Add
another layer to your digital privacy cake with Delete Me's data removal
services. Learn how they can help keep your information secure at
jointdeme.com/ltt20 and get 20% off to
boot. Before we go any further, what is recall again? And what was everyone so
upset about last time? I can't seem to
recall records everything that appears
on the screen of your computer. Oh, that's it. Windows Recall takes
screenshots, they call them snapshots, of whatever it is that you're doing on
your PC every few seconds and then feeds them through AI assisted optical text
recognition and image analysis, then stores it all in a local database for
your convenience. And they only need 10%
of your hard drive space to do it. Outstanding. The idea then is that you
can fire up recall and ask it things like, "Hey, what was that Korean
restaurant that Alice mentioned the other day?" And then without you needing
to remember whether it was an email, a team's message, or a random calendar
invite, Recall will crap out a snapshot that has the result for you. You can
even copy and paste text and images from within those saved snapshots to easily
search or share them, which I have to admit does sound kind of nifty. And
supposedly it is a lot more secure now. But I am not going to take Microsoft's
word for it. Not when I can compare them both side by side. You see, this machine
is running new recall. You don't need anything super special to use it, just a
co-pilot plus ready PC that meets the secured core standard. Also, a couple of
other things that any such machine would likely have. But that wasn't always the
case. See, the original Windows recall was only officially available on laptops
with Snapdragon X Elite and X Plus processors, which unfortunately we
didn't have access to at the time. But thanks to a legend by the name of
Albaore, we were able to get it up and running on this old HP Elite Folio,
which conveniently has been powered down with its radios off going I can't hear
you Windows update since before Microsoft delayed the launch, allowing
us to compare old recall to new recall.
Let's see exactly what's different. Well, for starters, recall is now hopped
in instead of being on by default. That is a very big improvement. But with that
said, Microsoft has a long, proud history of using dark patterns to trick
you into changing default system settings or even just changing them on
their own. So, I'm going to believe that this is permanent when I see it. Uh,
what else has changed? Well, Microsoft now says that recall is secure with the
data encrypted, protected by Bit Locker, and requiring Windows Hello
authentication. Of course, they said it was secure a year ago, too, though. So,
uh, let's make our way through this helpful FAQ from 2024 and compare what
they said then and how it behaves on both of our machines. Let's see here.
Recall snapshots are kept on the local hard disk. Okay, that was true before.
In fact, they're right here in this core AI platform folder under the user's
local app data. And okay, uh, yep, that
looks like it's still true. How about data is protected using disk encryption
and Bit Locker? Well, that was at least
partly true back in 2024, but was also
pretty misleading. See, Bit Locker would protect your data, including your recall
snapshots if somebody stole your device. But if you were logged in and you just
stepped away for a moment, then those snapshots would be protected only by
Windows permissions. And I don't know this for sure, but I think most elite
hack source are pretty good at clicking continue. All right, let's see what else
we got here. Uh, we've got show file extensions on, by the way. So, I'm going
to go out on a limb and guess that this DB file here is the database. And if we
look at the file header in a hex editor, it looks like it's just a SQLite
database. So, we can use any of the dozens of free tools out there to
interact with that. And there it is. Look at all Look at all
that plain text. Oh my god. I read about this back
then, but I didn't actually look at it for myself. It's just plain text. Yeah,
that's wild. And if I stretch my detective skills just a little bit
further, I would guess that that image store folder is full of
images. Oh, no. They're not images.
They're unknown files. I can't surely do
anything about this. Open with hex
editor. And would you look at that? JF,
which means Oh my
god. Boop. Watch this. I accidentally
figured this out. If I click and
drag, it previews it. Now all I need to
do is open it. And wow, I hacked
it. Oh man, that's a yikes. So that's
it. That's what Jordan was doing on his computer at some time. All the metadata
is just in there. Okay. Time stamp 2023
uh December 4th because this computer is set to 2024. So that's Yeah, that
probably is when we were looking at it. Pathetic. Let's look at the new one.
this database file right there. AES
encrypted. Also, where we had plain text before, now we have not so plain text.
Scrambledy scrambled. That's what we want to see. Okay. What about the image
store folder though? It's empty. It's a different folder now. A sim store. Okay.
All right. Cleverly hid them. Yeah. This probably a JPEG. Let's try the same
trick. Okay. No thumbnail preview. And if we
try to open it, no dice.
Okay, everything seems to be actually
encrypted this time. So, I got to give Microsoft a point on our scoreboard for
fixing that. But then I've also got to take a point away for lying about it in
the first place. So then, okay, old recall minus one point, new recall zero
points. Let's have a look at our next claim here. Microsoft won't view your
recall data or make it available for targeted
advertisements. Skeptic of me wants to add yet to the end of that statement,
but I would say that it was probably true when they were first testing and is
probably still true at the time we're filming this. Though once again, I feel
it's a matter of time before they quietly change this and then hope that
no one will notice. As for this next one, this is where things get
objectively really bad. Snapshots are
only available to the person whose profile was used to sign into the
device. If two people share a device, they will not be able to access each
other's snapshots. Okay, when we tested
this back in 2024, that was a straightup
lie and potentially a really dangerous one. By simply creating an administrator
account on the same machine, I could easily navigate to any other user's app
data folder and then check out anything that they had ever done on the computer.
Now, I hate to even have to bring up such horrible scenarios, but guys,
imagine this in the case of a journalist in an oppressive regime whose device was
seized by force or for a victim of domestic abuse who was trying to find
help online. As recall was implemented in 2024, a bad actor could have seen
everything their victim had done on the computer, and that was enabled by
default. Fortunately, that seems to have changed
now. Okay, stop recording OBS. You'll
have to take my word for it. I'm signing out. I'm signing in as other user. Core
AI platform UKP continue. Okay, so all
this still works. But because it's all
encrypted, we can't view it. So, with
the shift to optin, the addition of Windows Hello authentication, and things
seemingly actually being encrypted this time, it is a little less horrifying.
But I still don't think Microsoft has gone far enough to educate users on the
dangers of this feature. See, people do
still share accounts in 2025, and I guarantee you that most of your normie
friends are not going to pay attention to all the little icons that are down in
their system tray. So saying, "Oh yeah,
that little blue squiggle, that means you're getting surveiled, that doesn't
really cut it for me." Also, the old FAQ
claimed that recall couldn't be accessed by other applications or services. But
while it is possible that other Microsoft apps didn't access this stuff
back in 24, within days of the preview
launch, there were multiple tools that could extract recall data both locally
and remotely. So that particular claim
feels at the very least like a lie by omission. Take a look at Total Recall,
for example. The media called this a hacker tool, but what it really is is a
few dozen lines of Python that an AI assistant could probably crap out for
you in about 30 seconds. Total Recall copied the images and the database
folder, made a handy little report of all your window titles, and if you
scrolled through it, led to the discovery of yet another lie from our
pals at Microsoft. Microsoft claimed back then that recall didn't record
incognito Windows in most common browsers, Edge, Firefox, Opera, and
Google Chrome. plain as day. Here's a window title from
farc.com, which we only visited in a brief incognito session. Anyway, back to
other apps being blocked from recall data, at least on the new one, because
they're encrypted. Something like Total Recall couldn't be just randomly created
by a third party. But it's also clear
that Microsoft isn't even pretending that their own apps can't access the
data anymore. On our new machine, the new click to-do co-pilot feature
requires recall to be enabled and is by all appearances a other app or service.
So lie then and I guess it's gone from the FAQ now. So no longer a lie, but
certainly a change. Anywh who, the 2025 flavor of
recall adds a toggle that will filter sensitive information automatically,
which seems to be enabled by default, which is something. But it relies on the
AI recognizing that any information that you have on screen is sensitive. And I
really don't know if I would trust this guy to determine if my on-screen data is
sensitive or not. At least not yet. So,
what's the bottom line here? Well, I got to give Microsoft some credit. They
could have just powered forward and released recall in its primitive state,
but instead they listened to the outrage of the tech community and are making
what looks like a serious effort to address many of the issues with their
original recall launch. But with that
said, I still oppose the existence of this feature because of what it means
for our collective privacy. Cuz here's the thing. Even if you don't turn on
recall yourself, how do you know that everyone you're emailing or maybe
messaging in Signal hasn't linked their PC that has recall turned on? Now,
Signal has announced a new enabled by default setting to prevent screen
capture of signal chats on Windows. But that doesn't cover you for any other
chat, and it doesn't prevent someone from turning capture on in Signal if,
say, Grandma likes to use recall to help her remember things. And I mean, yeah,
that is pretty useful for her, but should baby pictures in a family
WhatsApp really be slurped into a Microsoft managed database? And yeah, I
know, I know, I know. It's stored locally and it's encrypted. But data is
only local until it's been stolen and it's only encrypted until some quantum
breaks that encryption. The very existence of recall makes Windows a
less secure platform because in the very near future, all compatible Windows 11
machines are going to have a built-in tool that gathers and catalogs an
unprecedented wealth of information about Windows users and then stores it
in a convenient place for attackers to target. So, if they're looking for some
confidential information, the heavy lifting is done for them. What are we
gonna have to do? Go back to writing letters? I mean, hey, at least we sell
the Scribe Driver pen on ltstore.com. You can use that to write a letter,
although then there's definitely a physical record of what you wrote. The
point is, I think Andrew Cunningham said it best on ours Technica last year.
Windows recall demands an extraordinary level of trust that Microsoft hasn't
earned. What a great turn of phrase. And what a great opportunity to tell you
about our sponsor, Delete Me. In a world
where you need an email or phone number to sign in to just about everything,
have you ever wondered who actually has access to your sensitive information?
Delete Me is willing to bet that this list is longer than you might think or
hope. And they're also here to help. Their data removal service will comb
through an exhaustive list of data brokers who are looking to profit off
your personal identifiers. Then they send regular removal requests on your
behalf, providing you with quarterly reports of where your info may have been
sitting around. And with their family plans, you and up to three other loved
ones can receive their protection as well. So take the steps to keep your
digital information secure. Visit
jointdeme.com/ltt20 and use code ltt20 for 20% off their data removal plans
today. If you guys enjoyed this video, maybe you'd like some mini rants about
small problems that make tech big awful.