Microsoft says it\u2019s making its new Recall feature in Windows 11 that screenshots everything you do on your PC an opt-in feature and addressing various security concerns. The software giant first unveiled the Recall feature<\/a> as part of its upcoming Copilot Plus PCs last month, but since then, privacy advocates and security experts have been warning<\/a> that Recall could be a \u201cdisaster\u201d for cybersecurity without changes.<\/p>\n<\/div>\n Thankfully, Microsoft has listened to the complaints and is making a number of changes before Copilot Plus PCs launch on June 18th. Microsoft had originally planned to turn Recall on by default, but the company now says it will offer the ability to disable the controversial AI-powered feature during the setup process of new Copilot Plus PCs. \u201cIf you don\u2019t proactively choose to turn it on, it will be off by default,\u201d says Windows chief Pavan Davuluri<\/a>.<\/p>\n<\/div>\n Microsoft will also require Windows Hello to enable Recall, so you\u2019ll either authenticate with your face, fingerprint, or using a PIN. \u201cIn addition, proof of presence is also required to view your timeline and search in Recall,\u201d says Davuluri, so someone won\u2019t be able to start searching through your timeline without authenticating first.<\/p>\n<\/div>\n This authentication will also apply to the data protection around the snapshots that Recall creates. \u201cWe are adding additional layers of data protection including \u2018just in time\u2019 decryption protected by\u00a0Windows Hello Enhanced Sign-in Security (ESS)\u00a0so Recall snapshots will only be decrypted and accessible when the user authenticates,\u201d explains Davuluri. \u201cIn addition, we encrypted the search index database.\u201d<\/p>\n<\/div>\n Recall uses local AI models to screenshot mostly everything you see or do on your computer and then give you the ability to search and retrieve anything in seconds. An explorable timeline lets you scroll through these snapshots with ease to look back on what you did on a particular day on your PC. Everything in Recall is designed to remain local and private on-device, so no data is used to train Microsoft\u2019s AI models.<\/p>\n<\/div>\n Microsoft\u2019s changes to the way the database is stored and accessed come after cybersecurity expert Kevin Beaumont discovered that Microsoft\u2019s AI-powered feature currently stores data in a database in plain text. That could have made it easy for malware authors to create tools that extract the database and its contents. Several tools have appeared in recent days, promising to exfiltrate Recall data. <\/p>\n<\/div>\n TotalRecall<\/a> extracts the Recall database so you can easily view what text is stored and the screenshots that Microsoft\u2019s feature has generated. NetExec<\/a> appears to be getting its own Recall module soon that can access Recall folders and dump them so you can view the screenshots easily. These tools are all possible because there\u2019s no full encryption or protection on the Recall database.<\/p>\n<\/div>\n Microsoft developed the Recall feature under its new Secure Future Initiative (SFI) that the company has put in place to overhaul its software security after major Azure cloud attacks. Microsoft has had a rough few years of cybersecurity incidents, and the SFI is supposed to focus on security above all else.<\/p>\n<\/div>\n Microsoft CEO Satya Nadella even called on employees to make security Microsoft\u2019s \u201ctop priority\u201d recently, even if that means prioritizing it over new features. \u201cIf you\u2019re faced with the tradeoff between security and another priority, your answer is clear:\u00a0Do security<\/strong>,\u201d said Nadella (emphasis his) in an\u00a0internal memo obtained by\u00a0The Verge<\/em><\/a>. \u201cIn some cases, this will mean prioritizing security above other things we do, such as releasing new features or providing ongoing support for legacy systems.\u201d<\/p>\n<\/div>\n Davuluri references Microsoft\u2019s SFI principles in today\u2019s response, noting that the company is taking action to improve Recall security. But it appears to be largely down to security researchers flagging these issues rather than Microsoft\u2019s own security principles, because surely these issues should have been flagged internally far before this launch. <\/p>\n<\/div>\n Microsoft is also keen to stress that Recall will only be available on new Copilot Plus PCs that are designed to be secure-core PCs with advanced firmware safeguards and the company\u2019s Pluton security processor that\u2019s designed to protect against personal data theft from a PC.<\/p>\n<\/div>\n \u201cAs we always do, we will continue to listen to and learn from our customers, including consumers, developers and enterprises, to evolve our experiences in ways that are meaningful to them,\u201d says Davuluri \u201cWe will continue to build these new capabilities and experiences for our customers by prioritizing privacy, safety and security first. We remain grateful for the vibrant community of customers who continue to share their feedback with us.\u201d<\/p>\n<\/div>\n<\/div>\n