Microsoft will switch off Recall by default after security backlash

Heres something I just don&#x27;t get. Microsoft just got their ass handed to them by the US Government because os (lapses in) security. Extremely more than coincidentally, Satya Nadella told the entire Microsoft org that if anyone had to choose between features and security, to choose security. I&#x27;m hearing from Microsoft people that all product roadmaps are deferred for a few months while security features are addressed. Their whole corporate spiel is &quot;Microsoft runs on trust&quot; (see the famous standards of business training on youtube).<p>And then someone goes and invents Recall. This is not the work of a lone engineer and a principal PM fishing for Impact or whatever they call success at Microsoft. This had to have gone through multiple levels of review. Microsoft PMs, CVPs, their corpo legal people, marketing approval. And yet no one stopped to say, &quot;wait, this could blow up in our faces&quot;?

It&#x27;s interesting to compare this to the Chrome&#x2F;Safari&#x2F;Edge browsing history, which is stored in an unencrypted SQLite database, and tracks what you do for the last 90 days. It&#x27;s just a bit less visual, Incognito&#x2F;Private modes work, and some users clear it more often.<p>But a <i>whole lot</i> of the surveillance attacks people imagine about Recall apply just the same to the browser. I think it&#x27;s the &quot;little brother&quot; casual attacks that are so well enabled by Recall - it makes it faster, easier, and way more visual.

When Recall is enabled, it should have an overlay stating that it is active so that all users are aware. Something at least as obvious as the old Windows activation overlay.[0]<p>Otherwise, every creepy roommate, bad partner, bad friend, etc... will take advantage of this to do bad things.<p>[0] Ideally more obvious, like when Windows screen recording is running.

Will have to wait and see if the extra security measures actually improve anything or not.<p>However regarding it being opt out… what would prevent a virus from just enabling it on a bunch of machines silently. Sure it would be caught but the damage done and most won’t be bothered to go in and disable it after.<p>Or Microsoft just decides they need to really market the hell out of AI and it gets turned on my default anyways.

I still don&#x27;t understand how this got this far. Enabling this in any corporate setting would be a compliance nightmare.

On LinkedIn someone in my network pointed out that, apart from the security and privacy disaster, the name Recall was a bad choice because of negative events like product recall.

What&#x27;s funny about this and other &quot;recalls&quot; (pun intended) of &quot;products&quot; from so-called &quot;tech&quot; companies as a result of &quot;feedback&quot;, or &quot;backlash&quot; as Wired calls it, is that the companies never asked for such input and AFAIK no one is contacting the companies to give it. AFAICT it is obtained through surveillance. To people born after the internet this might seem normal, but to me it is quite odd. The companies claim to be operating in service of &quot;users&quot; but there is generally no direct contact between these &quot;users&quot; and the company.^1 With some isolated exceptions that have increased over time, there is no customer service. And in most cases the &quot;customer&quot; has not paid the company for the so-called &quot;product&quot;. Generally, no one is asking a refund on their purchase of Windows because generally no one pays Microsoft for it. Instead people just complain into the ether.<p>No need to pay for being the target of surveillance. The &quot;products&quot; are free.<p>1. Unless we count the telemetry and &quot;auto-updates&quot;. Users never asked for this stuff though, it is not initiated by them. This &quot;product&quot; is broken on delivery hence the alleged need to keep &quot;fixing&quot; it by remotely installing more software, presumably that isn&#x27;t broken and will not used for surveillance, on peoples&#x27; computers. All for free. There is no money to refund if the &quot;product&quot; does not work as expected.

Few things that Recall can do: - Make sure Recall is per user and not something that can be installed system wide for all users.<p>- When a user enable Recall, it should ask to setup a &quot;Recall password&quot; and generate a private public key and use the password to encrypt the private key.<p>- Use the above public key to encrypt all the data it stores.<p>- When user wants to search Recall history, ask for the password, decrypt the private key and use the decrypted private key to decrypt the data and show the data to user.<p>- Show some sort of indicator on taskbar that Recall is running, not a tray icon (which can be hidden), but a proper big red circle kind of thing.<p>To me this seems like another case of MS top executives telling every team that they have to do something with AI. Typical approach used by many executives and managers - &quot;Here is a new tech, figure out a product to build with it&quot;.

I have a really hard time understanding the use case for something like this. Stuff that I want to remember I just write down or reference something like my browser history or recently opened files. It&#x27;s very low tech for sure but it works, is waaay more energy efficient, way easier to understand and audit, and doesnt have the same security concerns. I get that using &quot;AI&quot; has a Wow Factor that existing systems have but I cannot understand the thinking of folks that are OK with the trade-off. Ita just not even close for me.

Microsoft isn&#x27;t filled with morons, and they knew this would be the reaction. They always planned this &quot;retreat,&quot; and this retreat is actually an advance: if you completely missed the media tempest in a teapot, <i>the story would be that Windows is going to embed AI into every copy that will be able to track everything that is done on the machine and make inferences from it.</i><p>Now, the story is: <i>Microsoft has been forced to retreat, through public pressure, from tracking everything that its users do by default.</i><p>Complete success on Microsoft&#x27;s part. And the public that angrily reads headlines and angrily tweeted twice, vigourously pats themselves on the back for their &quot;victory.&quot;

This seems to be a feature that execs wanted, and people find creepy, and no one has the gumption to push back on the exec request.

Maybe a bit off-topic, but I sure wish they&#x27;d do this for OneDrive! I installed Windows for personal use for the first time recently (although I use it exclusively at work) and it drove me ABSOLUTELY BONKERS that my home drive was mapping to C:\Users\atribecalledqst\OneDrive.<p>What I hated the most was that the File Explorer just calls the folders in there e.g. &quot;Documents&quot; and &quot;Pictures&quot; without showing the full path. So it was hard to figure out just where in the file system you were looking -- a major annoyance if you do any work in the command-line!<p>Even after switching OneDrive off and doing as much as I can to try and get rid of the OneDrive folder structure, I haven&#x27;t been completely successful. You can make some -- but not all -- home folders (like Downloads, Documents, etc.) point directly to their place in the local user folder, but others, particularly Pictures, don&#x27;t seem to be movable. Additionally, some programs still seem to want to use the OneDrive folder by default, like I think Office programs still do their best to use them.<p>In the grand scheme of things it&#x27;s a small annoyance but god it annoys the shit out of me! I didn&#x27;t ask for cloud backup and it drives me nuts they tried to force it on me!

It&#x27;s interesting that for years Safari stored page screenshots in its history to allow a &quot;coverflow&quot; view and there wasn&#x27;t broad concern.

Good progress, but to take it just over the trust threshold for me, I&#x27;d like it to be a component that you can add&#x2F;remove (like Hyper-V or IIS); removing literally uninstalls the associated services, applications, DLL registrations, scheduled tasks, etc.

In all the MS Recall drama, I&#x27;ve yet to hear or read one single person utter something to the effect of &quot;Wow - great!!! - I&#x27;ve been waiting for something like this for years! This will solve at least one of the major issues I face regularly!&quot;. In fact, it seems to me the only people that really want this feature are the ones trying to push it down everyones collective throat. Why is MS pushing something so hard when nobody asked for it?

I don&#x27;t understand how recall even got launched. No one should have spent money developing it.<p>Yes, the idea is cool. But even if you trust Microsoft it&#x27;s obviously a privacy and security nightmare. How many people would install a keylogger on their own system? And then make that keylogger trivial to search through? It just makes windows computers extremely valuable targets for hackers and I&#x27;ll ban them on my networks even if relay isn&#x27;t enabled.<p>Edit: I imagine there&#x27;s going to be fewer keyloggers developed. Microsoft provides one for you, that&#x27;s officially signed, legitimate, and won&#x27;t trip antivirus systems. Attackers now just need to make programs that turn on replay. They can then wait. User sees replay running? They blame Microsoft. Legitimate software is so buggy that it&#x27;s not going to set off alarm bells. That virus just needs to lay dormant for a week or so. And if the user already had replay running, well then the attacker can extract information prior to their infiltration. Stuff that wouldn&#x27;t normally be logged even if the user had a keylogger.

Why have it all then?<p>Truth is they will have it off at first then an update will only do the windows folder and slowly creep from there. Another update will “accidentally “ turn it on then more options will be available and more will be defaulted on.<p>There will not be a single option but multiple toggles at some point.

Do we know anything about Linux support for Snapdragon X.. Personally, I don&#x27;t trust Qualcomm with Linux support. Their WiFi adapters don&#x27;t work properly with Linux. Their mobile SoC that supposedly have mainline support only have the CPU part working, but GPU, modem, Bluetooth, etc. won&#x27;t.<p>Also, wasn&#x27;t their history of closed source drivers and their short support timeline was the reason Android devices only ever got 2 years of updates only a few years back?

It&#x27;s sad that Microsoft (or any big company) wouldn&#x27;t take a step back from such privacy intrusive or anti-user behavior unless there&#x27;s a public backlash.<p>Can&#x27;t we just have a peaceful life without wasting time on constantly following and analyzing every single move from these companies?

Off by default, means On by Default When They Change Their Mind [tomorrow, next week, next month, etc]. Antitrust yesterday already.

Archive: <a href="https:&#x2F;&#x2F;archive.ph&#x2F;xlh7n" rel="nofollow">https:&#x2F;&#x2F;archive.ph&#x2F;xlh7n</a>

The first big mis-step of the Nadella era.<p>Will be interesting to hear what he has to say when he&#x27;s inevitably asked to comment in his next public appearance.

What I think MS should do if they <i>really</i> believed this is a thing people want is make it an actual sold product. Not free. Not a sub.<p>Just like when we used to have boxed software back in the day. Of course it would be on Windows Store or whatever hogwash they use to push software.<p>Remember when you had to actually take market risk to publish something and not just &quot;give it for free&quot;? I get times are past that, but if the market is good enough for Cybertruck, surely it&#x27;s good enough for Recall.<p>In fact, if I were the CEO I would do this just to allay FTC concerns about big-boi MS and their market power. Like how they made Office for the Mac when Jobs came back and to keep Mac afloat (or like how Google pays Firefox money).<p>Let the market decide, that&#x27;s what these capitalists claim to love, right (yes, I know we see through their bluff from both left&#x2F;right sides of the aisle - that&#x27;s me calling it there).

I think this will be definitely a &quot;for now&quot; moment until they let us all become a little bit more used to the idea.

make it a separate program that people can install if they want to. if its really that great then people will download it

Just clean wiped one of my Win11 PC for linux, so far everything looks good. The fan is not running in most of the time, and before that it was running like crazy.<p>Go M$, go faster. I have one more Win11 installation to wipe, probably two Win10 too.

This is nothing.<p>An abusive spouse will easily switch it to on. It&#x27;s very likely Windows will downright push you to do so anyways.<p>How does Microsoft intend to mitigate that harm?<p>Because AirTags worked out just fine:<p>&gt; AirTags have been a tool for stalkers and domestic abusers since Apple launched them in 2021. Police records show that this is a problem, and the legal system has failed women who were targeted by stalkers using AirTags. There have been several instances where AirTag stalking has turned violent, and in at least two cases, resulted in the tracker murdering their target.<p><a href="https:&#x2F;&#x2F;www.404media.co&#x2F;email&#x2F;ce4cec4d-51c3-4101-b2b4-2c9a64aee5e8&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.404media.co&#x2F;email&#x2F;ce4cec4d-51c3-4101-b2b4-2c9a64...</a><p>How many women will beaten and murdered because of Recall? Why is it that Microsoft reacts to software security concerns but not to the concerns of women?

&gt; Microsoft developed the Recall feature under its new Secure Future Initiative (SFI) that the company has put in place to overhaul its software security after major Azure cloud attacks.<p>The irony here is thick enough to cut with a knife.<p>But good on Microsoft for changing their minds and deciding to make this opt-in. That&#x27;s progress for sure.

I wonder how many other privacy-invading features Microsoft has announced, walked back slightly, then shoved in the next version of their OS as something that isn&#x27;t opt-in?

What exactly is a good usecase for Copilot Pro (I&#x27;m assuming Recall will be powered by that in some form)? I&#x27;m on the free trial and I&#x27;m not finding it to be any more useful than the free version, and pretty similar to ChatGPT.<p>It can&#x27;t really <i>do</i> anything.<p>Can someone smarter than I chime in on this?

I am done with Windows, I really love .net, SQL Server, WSL, but I have been burnt on so many of their tools, features etc, Windows 11 was the last straw (task bar unmovable? Are you kidding me? ), and Recall will be the never look back for my personal computing.

I only have a windows partition for games. I would occasionally use it for other stuff because it&#x27;s sometimes inconvenient to switch back and forth. After recall, I&#x27;m only using it for gaming and nothing else.

Too late. I&#x27;ve used Windows for over 30 years. Was never a &quot;fan&quot;, it just got the work done without getting in the way. Good tool.<p>But now I&#x27;m moving all my computers, including work computers, to Linux. Will miss out on some hardware&#x2F;software I use for music production (biggest loss will be TotalMix FX for my RME audio interface), but MSFT leadership has shown they don&#x27;t get it.<p>Also, Fusion360 for Linux when?

What the default was going to be regardless, except by now everyone heard of the product to the value of probably millions if not billions of dollars worth of ads (since so many people block them and here we all still read it on the news and ad-free social media like mastodon anyway)

I will let others be the early adopters on this one and see how it turns out.

Would love to know if any product research was done on this at all, or if it was a mandate from someone high up in Microsoft. I cannot imagine they&#x27;d go very long talking to potential users without hearing the exact same fears they seem to be surprised about today.

How about they remove ALL AI features, including Copilot? This is clearly illegal bundling that deserves swift anti-trust action. Microsoft is worse than ever, and far more bold with abuse of their market position than they ever were in the 90s.

&gt; requiring that users prove their identity via its Microsoft Hello authentication function any time they either enable Recall or access its data,<p>So now I need MS permission to read my own data stored on my own machine? Insane.

Did no one think of recall posting your key wallet passwords in plain text…

Even if it shows being turned off you can&#x27;t be sure it really is. And yeah they have a tendency to secretly turn malicious features on with little updates. One would really be naive to believe them after their past bad behaviour. It is just another step in slowly boiling the frog to death. Maybe it will be off by default only for as long as people get used to it and normalise it and then, next step turn it on again, more quietly of course.

And what happens when very few users opt in?<p>Maybe they should have done some research to determine if this &quot;feature&quot; actually had significant marketplace appeal.

What’s funny to me in all of this is I’m pretty sure regular windows search is still really bad and I haven’t heard them mention the feature “search for a file on your pc you know exists”.

Fairly certain it won&#x27;t be switched off by default in most corporate environments. Recall is one of the more impressive foot-bazookas to come out of MS since WebDAV in Windows 2000!

&gt;If you’re faced with the trade-off between security and another priority, your answer is clear: Do security,” Nadella&#x27;s memo read<p>Just insane that this wasn’t already the rule.

The problem is some conservative IT orgs will disable this for their suit and tie posturing approach to providing security, while not really securing anything.

It could still just be switched on and used to spy on an unknowing spouse for example... its just so creepy. Who asked for this feature?? No one did.

The feature is dead and will only be a drag on Windows, Microsoft, and their public perception.<p>Throw in the towel, it has been besmirched to the point of no return.

For now and unless turned on remotely or after every damn user is nagged to turn it on or after sneakely turned on with the next Edge update or ...

Classic 2-step move, introduce what you want to ship but add a red herring, remove red herring on the outrage, ship it.

without seeing an actual data file created by recall, i would expect it to quickly become large.<p>if so, i would not keep it on a system drive, when you can store it externally, to be plugged in when the owner feels they actually need recall data, and left physically out of band when its wise to do so

As Opt-In Opt-Out ever mattered on Windows. One tiny update later and your settings are messed up again.

Hmm the real question is:<p>Will you be warned when sending information to someone who has Recall on?<p>Kinda defeats the purpose of all those confidential communication apps when everything is automatically screenshotted.

i feel like an open source version of this would be really cool.<p>theres a lot of people who have a lot of data they wont want to put into this and run other people&#x27;s closed source code and you dont really know what its doing.<p>is there an open source linux friendly equivalent?

I think Recall is really cool and it&#x27;s a shame that it&#x27;s disabled.

FF should create a DRM that uses the bullshit webdrm standards and apply it to the entire sandboxed experience. Lock MS the fuck out. Oh you want passwords? Sorry bucko. It&#x27;s DRM&#x27;d. What&#x27;s good for Hollywood execs is good for End Users. (but we don&#x27;t get the phat stacks of cash).

wait wait wait- Are they going to do a recall on Recall? What a crappy name for anything sold in the history of all the things

The whole of Microsoft should be switched off

I hope it can be uninstalled altogether. Actually I wish it was a Microsoft Store app. I mean, I don&#x27;t want that codepath dormant in my OS for malware to enable via a Windows Registry value or whatever. No, not a screenlogger please.

I’m honestly not surprised they came up with this considering MS’ track record on security since the internet exists.<p>One more reason to resist their extend embrace extinguish strategy and not use their tools (vs code etc), this won’t end well and Microsoft will always be Microsoft.

Security backlash?<p>Should be security concerns

no problem<p>we&#x27;ll find a way to turn it on, and share it with our corporate partners

...until they can find a way for it to be introduced without resistance.<p>Let&#x27;s not pretend several decades of unscrupulous behavior is going to change now. Unless regulatory structures get implemented to brutally, exactingly, unflinchingly and relentlessly punish firms, they won&#x27;t stop trying.<p>Punitively maul them into submission.

... or make a OneDrive-connected folder have an icon that shows, clearly, that it&#x27;s been taken over by OneDrive.<p>I&#x27;d give a setup option to provide a non-OneDrive Documents folder, that feature would be turned on automatically if OneDrive senses that there is a database residing in the Documents folder (ACT!, I&#x27;m looking at you!)

Is this just another case of going half step back after public backlash, only to go two steps forward when everyone forgets about the issue?

Not at first, anyway.

All I can say is LOL. Off by default for Windows 11 24H2, on by default in Windows 11 25H2, impossible to disable in Windows 11 26H2 (except in enterprise versions of course). Microsoft&#x27;s history with respecting the user&#x27;s wishes speaks for itself.

What makes my blood boil is that they are just going to keep pulling shit like this which they KNOW everyone (with zero exceptions) intensely HATES, and it&#x27;s up to everyone to push back <i>ferociously</i> (very high threshold) every damn time. It&#x27;s up there with &quot;not now&quot; instead of &quot;get rekt and never ask me again&quot; choices in terms of user-antagonism.<p>I&#x27;m aware that other OSes exist, but I happen to hate Windows least on the whole :&#x2F;

Doesn&#x27;t Microsoft have a long history (and present) where they just enable privacy invasive &quot;features&quot; after a windows update even though the user has disabled or removed the &quot;feature&quot;?

I&#x27;ve been a Windows user since 3.1, but this was the straw for me. They have always provided an OS that just worked for my home needs, even with the creeping privacy invasions in the last update.<p>I&#x27;ve been dual booting for a while and last weekend I went full Linux at home. My day job revolves around being truly good at solving Windows issues, and I will happily continue doing that, but at home I&#x27;m still just liking for something that &quot;just works&quot; I hope I&#x27;m part of a trend, and that 2024 is the year of the....

Looking forward to the update that accidentally re-enables it.

Only to be enabled by default by the IT department of your mistrusting employer. Microsoft better remove Recall altogether if they want to avoid costly lawsuits.

They should&#x27;ve left it disabled, and then &quot;accidentally&quot; enabled it, or nagged people into enabling it. I think it would&#x27;ve boiled the frog slower and been more successful.<p>Alternative cynical take: they needed to have a compelling story for press&#x2F;launching the laptops they&#x27;ve been working with software&#x2F;hardware partners on for years. They got to announce &quot;Copilot+ PCs with Total^H^H^H^H^H Recall&quot;! And now they get to walk it back enough controversy will die down and they can still do the first bit I mentioned. Hm.

Then they&#x27;ll enable it by default once people forget

Recall got recalled(ba dum tss).

Lawyers, law enforcement, and three letter agencies everywhere are going to be extremely disappointed by this development.

Hopefully any debloat tools will remove it quickly. Can&#x27;t wait until Microsoft force pushes this spyware to the masses.

I switched to Macs in 2006 and haven’t felt like Windows’ grass is greener once since then. Until today.<p>Maybe it shouldn’t be on by default, but this looks amazing.

Oh man this is totally going to affect:<p>&gt;My workplace<p>It wont affect me personally, because I dont use crappy operating systems on my personal time. Microsoft products are just an efficiency loss, I still bill the same.<p>I literally get everything done faster on Fedora, no linux prayer needed anymore. Its just better.

Microsoft keeps attempting to violate HIPAA on my clients’ behalf. Before this, they turned on OneDrive backups via updates, and began moving sensitive documents onto their servers without prior authorization or consent. I documented the incident, because I honestly wasn’t sure whether or not a lawsuit would result from it. I notified Microsoft, but never got a response.

Recall certainly validates China&#x27;s government decision to try to get rid of Windows on government computers (<a href="https:&#x2F;&#x2F;www.marketwatch.com&#x2F;story&#x2F;china-reportedly-seeks-to-block-intel-amd-and-microsoft-tech-from-being-used-in-government-computers-52957bee" rel="nofollow">https:&#x2F;&#x2F;www.marketwatch.com&#x2F;story&#x2F;china-reportedly-seeks-to-...</a>). Of course recall wouldn&#x27;t have been enabled on those, but the company providing the OS has made it clear they&#x27;re willing to make such a sloppy attempt to AI all the things

It is puzzling to me that so many people seem to think this concept has no value. To me the concept is obviously good and something I have wanted for a long time.<p>Of course the security of the implementation is important and I agree with some of the criticism there. But I see a lot of people arguing that the feature is worthless, or that it doesn&#x27;t make sense at the OS level, or that Microsoft specifically should not be allowed to add it to Windows, and I have to strongly disagree.