Microsoft delays Windows Recall rollout, more security testing needed

Microsoft is delaying the release of Recall, a controversial Windows 11 feature that will allow users to search their computer for specific content that has previously been viewed by them.

A preview of Recall should have been broadly available on June 18, 2024, when Microsoft’s Copilot+ PCs are scheduled to be released. But for now, it will only be made available to participants of the Windows Insider Program (WIP), in the coming weeks.

“We are adjusting the release model for Recall to leverage the expertise of the Windows Insider community to ensure the experience meets our high standards for quality and security,” the company said.

“Following receiving feedback on Recall from our Windows Insider Community, as we typically do, we plan to make Recall (preview) available for all Copilot+ PCs coming soon.”

The objections to Windows Recall

Microsoft’s Copilot+ line of Windows 11-powered PCs and the Recall feature were unveiled in late May, 2024, but the feature immediately raised many concerns with security professionals and privacy advocates.

Recall makes screenshots of the user’s screen every few seconds and both the images and the information extracted from them is poorly secured, they argued, and stressed that the feature must definitely not be switched on by default.

After additional testing and an open-source tool revealed how easily malicious individuals could abuse the feature to steal sensitive information, Microsoft announced some changes: it would make Recall opt-in, it would encrypt the database with the information compiled from the screenshots, and would require Windows Hello enrollment to enable the feature.

The Recall “pause” has been welcomed by security researcher Kevin Beaumont, whose persistent, outspoken objections have surely contributed to it.

“Good on Microsoft for finally reaching a sane conclusion,” he noted. “When [Recall] does appear in preview channels, privacy and security researchers need to keep a close eye on what Microsoft are doing with the feature.”

Microsoft doing damage control

Microsoft’s latest announcement about pausing Recall’s rollout came right after ProPublica published a report based on revelations by a Microsoft whistleblower, who said that the company chose not to address a critical vulnerability – which later ended up being exploited by state-sponsored attackers – because they feared losing government business.

On the same day, Microsoft President Brad Smith testified before the US Congress on how Microsoft aims to address the much needed improvements in corporate security culture, cloud cybersecurity practices, transparency, notification process, and more.