Recall: Stealing everything you've ever typed or viewed on your own Windows PC

Everything a user has ever seen, ordered by application. Every bit of text the user has seen, with some minor exceptions (e.g. Microsoft Edge InPrivate mode is excluded, but Google Chrome isn’t).

Microsoft was the company that used to add bespoke code to Windows to maintain compatibility with old third party software, patch explorer.exe to stop third party customizations from crashing it, etc. While the whole Recall thing is a pretty bad idea for most users, the lack of care extended to the third party browser with overwhelming market share among their users is just sad. Are they counting on people switching to Edge because “PSA: you’ll be recorded if you watch pr0n in Chrome!”?

The privacy concerns here are real and massive, and I suspect this will get worse before it gets better.

However. This is the holy grail of computer usage. A good version of this could be the killer app for modern AI. Because of that, ripple are going to keep trying to make this feature happen. There’s already a popular implementation on macOS. I’m excited for the end-state, but apprehensive about getting there.

For a moment my perception of Microsoft was that it has become a cool company (github acquisition, Linux Sub-sytem). I was impressed by how Satya Nadella turned the company around (at least in terms of image).

Between Recall and the mandatory account login to install Windows 10 I am progressively reverting to how I felt about them.

Recall can't be disabled during the Windows setup. It has to be disabled manually in Windows settings.

https://x.com/tomwarren/status/1796681578984182066

Am I missing something or is this as big of a disaster as I think? This is terrible news right?

There was a movie about this exact thing. Antitrust (2001) was about a Microsoft-like company monitoring everyone’s computer and stealing code.

23 years later and here we are.

This is something you have to specifically enable right? Right?!

I’m sick of brain dead execs and product managers. What world do these people live in?

That was very well written and reasonable, neither minimizing the risks nor succumbing to hysteria.

The idea behind Recall, universal, machine-assisted search, is a good one but it's embarrassingly clear that in terms of implementation, this ain't it, chief. Microsoft should do what Google has done with Sky -- withdraw the product, take the hit, and hope that something can be salvaged from this debacle, both in terms of an improved product, and better company-wide testing and rollout practices.

2017: People are willingly buying a spy device to put into their homes.

2024: People are willingly activating a key logger.

Recall needs to ship as a completely separate application. In fact Microsoft should also charge a nominal fee for it so no one accidentally installs it.

Still this is the worst spyware ever made. Have a telehealth appointment, lawyer conference, loan application, now Recall will store all that like it or not.

This made me decide to go with a non Snapdragon Laptop since I want nothing to do with this. Gonna dual boot with Fedora ( sorry Debain, but it looks like Stable is a bit behind what I need hardware support wise).

Microsoft is making a serious argument for going full Linux + maybe a PS5 for competitive gaming ( since anti cheat is Windows only by design).

I think, roughly, having good access to information is a super power (good being a mix of mostly: quick, simple, easy, accurate, free). My personal information is most valuable to me, so having access to that is specially powerful.

The only way to make that happen is to store that information somewhere. The best way to do anything, that I just want the benefits of, is automatically.

And now we are here. It feels monstrous but, to me, the above still stands. How to connect the dots to get to a place that feels good, I do not know. I would not be shocked if it turned out to be mostly about adjusting ourselves to it over time.

But I am almost 100% positive we will all* want this super power, in some much better and much more complete form, in our future lives. And not being able to have it will feel absolutely silly, from there on out forever.

Let me be clear: I will literally burn any computer equipped with this technology I am forced to use and post the aftermath online.

This is societal cancer. Total information monitoring is the death of any semblance of human independence and should be violently resisted.

I have never been more disgusted by a management team. How clueless can you be? Combined with digital intelligence, this technology is profoundly dangerous to anyone who works with a computer or technology (which is almost everyone).

What a lot of people are missing in all this is that Microsoft is coming from one, dialing it up to eleven to then dial it back to 9.

By pushing this onto people in a hard way they open the door to come up with a mitigating solution that later is far beyond what we had before recall but not as bad as what they pushed onto people in the first place. So they will reach their goal, as it was never 11, it was always 9.

When Steve Jobs said Microsoft had "no taste" to Bill Gates during an interview, I think one aspect of that is that Jobs had high EQ as well as high IQ. Jobs understood how people felt about products. Microsoft doesn't. When I worked at Microsoft I don't remember any conversations about how people would feel about a feature. That was awhile ago, but it looks like nothing has changed.

I'm trying to square the claims in this article with what Microsoft says.

Article: "This database file has a record of everything you’ve ever viewed on your PC in plain text"

Microsoft: "Snapshots are encrypted by Device Encryption or BitLocker, which are enabled by default on Windows 11."

https://support.microsoft.com/en-us/windows/privacy-and-cont...

The article is a little bit hand-wavy about how exactly the database comes to be decrypted and remotely exfiltrated. The headline says it takes "two lines of code" but unless I'm missing it, I don't see those lines discussed in the article.

I'm confused. According to the article, several days working results in a 90kb compressed DB. If that's the case, it can't be capturing all the text you see, including web pages - perhaps "working" here doesn't involve general web browsing? What am I missing?

I used to work on Windows at Microsoft, prior to Windows 10. I've always kept some Windows machines around because I felt that Windows was actually not that bad of an operating system, having personally reviewed a good amount of its source code and seen what the engineering culture was back at the time I was there.

I gave ChromeOS a try for some machines I might otherwise have run Windows on, but I kept the Windows machines around for gaming and for the occasional oddball proprietary software package that some family member just had to have. About the time Google dropped its unofficial motto "Don't Be Evil" I started moving away from ChromeOS and back to trusty old Debian.

I've recently purchased a Framework 16 with an AMD Radeon RX 7700S GPU and installed Arch Linux and Steam on it. All the games I care about playing at the moment, including Elden Ring and Baldur's Gate 3, run phenomenally well on it. It's 100% stable driving a 2560x1600 display at 60+fps with high graphics settings. I can plug in a PS5 controller and it "just works."

With that I now feel truly free of anything Microsoft, in the sense that I don't feel like I'm making any compromises at all with how I want to use my computers by using Linux rather than Windows. I'm going to be installing Arch or Debian Linux on my remaining Windows boxen over the summer.

So this is my final adieu, my old friend Microsoft. How far our paths have diverged since we first parted ways. Hit me up again when you've extricated your OS from your cloud and stopped showing ads and integrating privacy-hostile features. I won't be holding my breath though.

because malware can now target a single file with huge amounts of valuable information

By that logic password managers are also no-no.

My hot take on this has been that although the tech community universally hates this - the sales and management types that drive these decisions will love it, and recall will go down as a resounding success for Microsoft. You're also going to find disabling it reduces your 'azure score' which is absolutely used by such types as a measure of their sysadmins skills.

Meanwhile, features like "secure" boot will stop you from patching this spyware out when it inevitably becomes impossible to disable completely via ordinary means, and even if you manage to find an exploit to "jailbreak" through, remote attestation will ostracise your machine from all the services that will eventually use the "telemetry" gathered to grant or deny you access based on how "human" you are.

The domestic abuse point is a chilling one

An abuser being able to access their partners/kids computers and go and see every thing they have done is terrifying

Can we just not do this at all?

As far as I can see based on the data already posted online, this is literally the Windows 10 Timeline feature, it even (re)uses the same API from that feature (that was deprecated just 3 months ago) and apparently shares the implementation as well (that feature also used a sqlite DB in your AppData and a subfolder with jpegs).

They just put a little AI lipstick on that old pig in the form of OCR and some image classification.

The Windows 10 Timeline feature has been around for 6 years. It is a bit surprising there is so much pushback this time around for effectively the same thing. I wonder if it's because Microsoft has been burning away people's trust through ads and dark patterns and all that bullshit, and this is the direct result of that.

I don't see Recall being axed.

Disabled by feature flag? Sure.

Disabled by default? Sure.

Once Windows stops having administrator accounts, they'll enable it by default.

As Smith would say, "it's inevitable".

I genuinely like Windows. I was raised on it, and have used every consumer version since 98, and have programmed on it since Windows 7. I believe that from a purely technical, systems programming, and even UI/UX perspective, it is superior to the competition—both commercial and free/libre open-source. I will be very happy to defend this statement as factually and reasonably as possible, because I also program on 'the competition OSs' at work, and every time I do so, I want to go back to a cohesive platform like VS 2022 which, for me, is unparalleled in terms of productivity.

But this sort of tone-deaf move from Microsoft is irritating me. I already dislike Windows 11's UI and UX flow because it is so reminiscent of macOS; this is why I haven't updated to it on my personal main computer yet (which is running Windows 10 Education, courtesy of my alma mater's Azure subscription). I've seen rumours that Microsoft hired a bunch of UI designers who used nothing but macOS and decided it was a good idea to port macOS UI designs to Windows. What a terrible terrible thing. UI responses that are instant even on Windows 10 now have a jelly-like lag to them on Windows 11, for no good reason. Also consider the regression of the right-click context menu, the ads and Copilot everywhere, a preference for unlabelled icons over text, amongst many others.

As another comment says, Windows Recall appears to be an AI evolution of the already-present Windows Timeline feature. The privacy outcomes of this are concerning and I really really wish we didn't have 'AI' and 'Copilot' stuffed down our throats all the time. I would like to opt-in to features I want, rather than have them all pre-enabled. Some of them are very useful, like clipboard history with Windows-Ctrl-V; some less so and are flagrant privacy violations.

I have already disabled almost every tracking, phone-home and auto-update feature possible using group policies; this is just another thing to add to my list of disabled 'help' features.

That being said, if Recall doesn't phone home—which appears to be the case here—I don't buy the argument that 'it's stealing everything you do and hackers can access it if they have physical access'. I believe that the moment a computer's physical access record is compromised, the entire computer is compromised, regardless of security theatre like disk encryption in the form of BitLocker/LUKS, Secure Boot etc. It doesn't matter whether Recall is present or not.

Threads on similar "apps":

"Show HN: Rem: Remember Everything (open source)", 196 comments, https://news.ycombinator.com/item?id=38787892

"I made an open source Windows app to rewind and search everything on screen", 166 comments, https://news.ycombinator.com/item?id=40105371

"Rewind: The Search Engine for Your Life", 92 comments, https://news.ycombinator.com/item?id=33421751

I just assumed windows work computers were doing this already.

Holy shit, when I was doing litigation these databases would be my wet dream.

I might seriously quit my job and start a discovery consulting / tech company just for targeting these databases.

Beyond the technology community I doubt that the loss of personal privacy is being discussed at large. Ad trackers had already made internet privacy a myth for the vast majority of the world; we now are seeing this permeate onto personal devices and subsequently to our environment with these always on, silently tracking devices - in the name of convenience.

Perfect recall, no need for memory, available at your fingertips - with T&C that completely disregards your need for personal privacy.

The challenge though is the "better" alternatives where a mix of privacy and convenience is there is not always convenient. We have and continue to be marketed convenience at the cost of privacy.

What we need is consumer data privacy to really become a societal and government concern and for devices which infringe on this to really go through the same scruity as say a drug going thru FDA approval.

I am not sure about this, but this new feature requires a dedicated AI chip (or maybe even a decent enough GPU), so,… here’s to hoping the guys behind shutup10 can integrate a patch to disable this.

Seems like the Key & Peele's Computer History sketch needs an update.

https://youtu.be/s0lUbqDrFWU?si=47kGfhA-PVuctWep NSFW

The only silver lining on this is that, previously, the idea that your computer might visually spy on everything you do and index it for easy searching was the domain of paranoid conspiracy theorists.

So I guess at least marketing that as a feature now makes it obvious that it is possible, I guess.

The real question is why the hell can said infostealer malware access the file.

Can we PLEASE have proper per-process file access restrictions on Windows already - like MacOS has had for a decade now ????? Why is win32 app isolation still not done?

This is so wild. What kind of a-hole in the C-level suite of MS thought this was a good idea?

Considering how stupid/unsophisticated an avg computer user is. The worlds scammers income is going to sky rocket in the next few years as more people get new computers with built in recall.

Well, we've got the next 6 months to make 2024 the year of the Linux desktop...

During testing this with an off the shelf infostealer, I used Microsoft Defender for Endpoint — which detected the off the shelve infostealer — but by the time the automated remediation kicked in (which took over ten minutes) my Recall data was already long gone.

Yeah... This is a BIG issue with the modern generation of antimalware solutions.

The old signature-based detection is great and immediate. But it has drawbacks. It only detects already-known malware. Not tailored stuff used only on one specific target. Also, malware can change its own signature adaptively. and hook into known-safe binaries.

So, a modern antimalware uses AI learning and behavioural analysis. Why is notepad.exe suddenly logging all your keywords? Ban it. The problem is: This takes a while. The tool can be configured to block it before someone looks at it, but it still takes a while. At the point that this happens, the damage is often already done.

At an enterprise level this is not a huge problem because it does mean the problem is detected, and by the time it is investigated it's possible to stop the source of the malware and ban it from all the other 100.000 PCs by using signature detection or other mitigations. On personal PCs this is more of an issue because they don't have a dedicated SOC (Security Operations Centre) jumping on to these things.

Also, the noise level is an issue in the enterprise, set the detection threshold too high and your SOC gets overwhelmed by all the detections and becomes ineffective.

Anyhow, this is indeed a good argument against Recall. When it was first introduced last week, people stated that it wasn't a big deal because malware can install its own key/screen logging. However a repository of the last 6 months of activity is indeed a very juicy target to exfiltrate quickly before detection.

Related threads:

"Giving Windows total recall of everything a user does is a privacy minefield", 41 comments, https://news.ycombinator.com/item?id=40470806

"AI PCs are the final nail in the coffin of open computing", 60 comments, https://news.ycombinator.com/item?id=40436975

"How the new Microsoft Recall feature fundamentally undermines Windows security", 50 comments, https://news.ycombinator.com/item?id=40433884

"Windows Recall sounds like a privacy nightmare", 298 comments, https://news.ycombinator.com/item?id=40443682

  The idea other people with access to the device could see a photographic memory is.. very scary to a great many people on a deeply personal level. Windows is a personal experience. This shatters that belief.

2003, https://en.wikipedia.org/wiki/DARPA_LifeLog

>The objective of the LifeLog concept was "to be able to trace the 'threads' of an individual's life in terms of events, states, and relationships", and it has the ability to "take in all of a subject's experience, from phone numbers dialed and e-mail messages viewed to every breath taken, step made and place gone".

2007 Microsoft Research, https://www.microsoft.com/en-us/research/video/the-microsoft...

> The SenseCam is a personal, wearable camera developed by Microsoft Research in Cambridge, UK, and used as a lifelogging device in projects like MyLifeBits.. is based on wearing the SenseCam for lifelogging of ‘events’ during your day, and generating a fast-forward movie of the event as the memory recall interface.

2010 Microsoft Research, https://www.microsoft.com/en-us/research/publication/now-let...

> Lifelogging technologies can capture both mundane and important experiences in our daily lives, resulting in a rich record of the places we visit and the things we see.. Previous work has demonstrated that Lifelogs can aid recall, but that they do many other things too. They can help us look back at the past in new ways, or to reconstruct what we did in our lives, even if we don’t recall exact details.

https://www.microsoft.com/en-us/research/project/mylifebits/ & https://en.wikipedia.org/wiki/MyLifeBits

> MyLifeBits is a life-logging experiment begun in 2001. It is a Microsoft Research project inspired by Vannevar Bush's hypothetical Memex computer system.. The "experimental subject" of the project is computer scientist Gordon Bell.. For this, Bell has digitized all documents he has read or produced, CDs, emails, and so on. He continues to do so, gathering web pages browsed, phone and instant messaging conversations and the like more or less automatically. The book Total Recall describes the vision and implications for a personal, lifetime e-memory for recall, work, health, education, and immortality.

Lifelogging was referenced by 10,000 academic papers over two decades, https://scholar.google.com/scholar?q=lifelogging

It's a thinly veiled ploy to get training data to train their generative AIs in user activity with the hopes of teaching AI the workflows of people, so it can replace them.

Ahhh, I knew it was important to keep my 20 year old SGI fuel. :P

Remember when we used to warn about software that phoned home?

Malware?

Keyloggers?

Adware?

Rootkit DRM?

Turns out they changed what "it" is, and I'm not even halfway to my pension yet...

I find the irony that I keep getting advertised the podcast* by some VP of Security ding-dong at Microsoft *delicious*.

(* I am intentionally not stating the name because they don't deserve the attention or free advertising)

Can't wait for the first corporate legal case where discovery requires them to present the entire history of a person's computer usage, not just their communications.

If you're capturing screen shots, then how is something like using Signal or some other encrypted service still possible?

I had to make it through 3/4 of the article before realizing that "Copilot+" is not, in fact, Copilot, or an enhanced version of it, but a line of computers. The marketing department also has some work to do.

I regularly get spam claiming that a hacker has compromised my device, has been filming me jerking off through my own webcam, and will send screenshots to my friends and family if I don't send them bitcoins. You know, the usual.

Once Recall is out the story will go from laughable to worrying - all they'll have to do is change their text to include instructions to open Recall (the same way old websites would open 'file:///' to show they 'knew' what's on your PC) and regular people will lose their minds (and money).

And then there's the age-old adage "if you can see it you can exfiltrate it" - it didn't work for DRM and it won't work here. Malware will steal this data.

when is this ever going to end? computing is so promising but we use it for activities like this....

Hackers can't get it

Same as

The Tesla will never crash in FSD

Same as

out platform is hacker proof

I used to use Manictime[1] to achieve something similar, although, that was for time tracking purposes. But I can admit I've used it multiple times to find websites and documents that I forgotten the name of using the screenshots. But in essence, It suffers from the same flaws as Recall.

[1] https://www.manictime.com

I have shared a similar post about another app of the same kind. It is called Invisibility (already using it, but concerned)!

https://news.ycombinator.com/item?id=40530354

It’s just a matter of time until they introduce an InTune feature to enforce this setting and send AI-written summaries of all employee behaviour to management.

https://x.com/AlexBlechman/status/1457842724128833538?lang=e...

“the future of windows is cloud”.

Seems to me like Microsoft probably sees Recall as

a. A way to capture more personal data and sell it to advertisers, or

b. A way to make Windows even more attractive to enterprise customers so that managers can snoop on employees, or

c. A handy feature that most users will want.

What Microsoft is saying publicly is c, which in itself is a red flag that suggests it's probably not true. The other red flag is that even as tone-deaf as Microsoft is about user wants and desires, even they can't be stupid enough to believe most users want this. So it's gotta be a or b or both.

Welp, I said before I would wait and see instead of directly dismiss the feature, and now I have my answer. That will be another of these feature to hard disable after windows install…

Imagine using windows in 2024

Neither these two paragraphs or the source they’re paraphrasing (https://doublepulsar.com/recall-stealing-everything-youve-ev...) indicate anything matching the headline at all.

The source article is a QA with himself. There’s 1 tweet references, that shows a screenshot of a truncated SQLite db that shows a log of the applications opened via the user UI shell: https://x.com/gossithedog/status/1796218726808748367?s=46&t=...

Whoopty doo. There are many, many sources throughout Windows that can give you a list of recently opened applications (that have existed for 10-25 years)

Seems like the Key & Peele's Computer History sketch needs an update.

https://youtu.be/s0lUbqDrFWU?si=47kGfhA-PVuctWep NSFW

Q. Are Microsoft a big, evil company?

A. No, that’s insanely reductive. They’re super smart people, and sometimes super smart people make mistakes. What matters is what they do with knowledge of mistakes.

Never attribute to malice that which can be adequately explained by neglect, ignorance or incompetence.

But

Q. Did Microsoft mislead the BBC about the security of Copilot

A. Yes.

Q. Have Microsoft mislead customers about the security of Copilot?

A. Yes. For example, they describe it as an optional experience — but it is enabled by default and people can optionally disable it. That’s wordsmithing.

Maybe at some point we should reconsider.

Another great reason to use Linux.

The real harm in Recall and I so much wish there was an authority who stepped in and slapped Microsoft into next week because of it: abusive relationships. Now your abuser can see everything you've done on your computer so if you try to get out your situation will worsen and also because of this you might not dare to seek help on said computer.

The real harm in Recall and I so much wish there was an authority who stepped in and slapped Microsoft into next week because of it: abusive relationships. Now your abuser can see everything you've done on your computer so if you try to get out your situation will worsen and also because of this you might not dare to seek help on said computer.

I haven't typed or viewed anything on any Windows PC in like 15 years. And I think anyone shouldn't....

Keep pushing chaps...

Windows already had a built in keylogger with Window 10 (https://www.pcworld.com/article/423165/how-to-turn-off-windo...) but all that data was only going to Microsoft and couldn't be accessed by you or anyone with access to your device.

Law enforcement, attorneys, and three letter agencies must be extremely excited about Recall. Now they won't have to hope that MS has records of everything you've typed while using your device, because with Recall all of that evidence will be stored on the device itself.

"If one would give me six lines written by the hand of the most honest man, I would find something in them to have him hanged." imagine could be found using everything a person ever types on their computer.

I am trying not to be reactionary but I swear, my usual response to the announcement of a new Windows feature is often "... and how do I turn that off?"

Still, sqlite ... tempting. Sometimes, if I am missing something I read months or even years ago, the right query to the sqlite files Firefox keeps can give good results.

It should be called "Clean Sweep".

This feature isn't for individual users, it's for corporations that want to control their employees.

If a corporation was a man, it would be a tyrant that demands to know everything its subjects do and think, and wants to control what they do and think.

Recall will track every you do this would be a massive invasion of privacy if Microsoft didn't already track everything you do.

Time to stick to only gaming on windows. I’ll use a dedicated and locked down Linux box for everything else.

The overwhelmingly negative reaction has probably taken Microsoft leadership by surprise. For almost everybody else, it won’t have.

I sometimes (always) wonder which planet Microsoft leadership live on - it's certainly not the real world that you and I live on.

I dont even need to read beyond the title for a change, its been more than 10 years now since I have used windows in a business environment (linux on my main machine, mac for my second) and there is already no way I would go back to it.

But good grief wtf. I was mostly joking when I said before MS was intentionally trying to kill windows, but is there actually any other explanation for implementing this "feature"?

Is there a law enforcement analysis tool for this yet?

Why stop there? It should also transcribe videos and everything said around the computer. Then, since it becomes possible to deduct the users opinion about just about everything if need be failing back on friends, family and coheard association it can also do our shopping and autofill the voting ballots silently on the background, without bothering me.

I mean, I have no idea how to stop laughing inappropriately at the moment but I know the product exists, that it can be delivered to my doorstep and that I can afford it.

1. Turn user activity into data

2. Turn data into AI that replaces users