Windows Recall Privacy Risks Persist

🔑 Enhanced Key Takeaways

• •The vulnerability stems from the unencrypted storage of the Recall database in a local SQLite file, which remains accessible to malicious actors or malware once a user session is authenticated.
• •Microsoft has transitioned Recall from a default-enabled feature to an opt-in experience for Copilot+ PCs following significant backlash regarding the initial security architecture.
• •Security researchers have demonstrated that the Recall indexer service runs with high-level privileges, allowing it to capture sensitive data from applications that explicitly request privacy or incognito modes.

🛠️ Technical Deep Dive

• •Recall utilizes a local SQLite database to store metadata and screenshots captured by the Windows AI component.
• •The feature relies on a local Small Language Model (SLM) running on the NPU (Neural Processing Unit) to perform OCR and semantic indexing of user activity.
• •Data is processed entirely on-device, but the lack of per-user encryption for the SQLite database allows any process with sufficient user-level permissions to read the captured history.
• •The system uses a 'Recall Indexer' service that monitors screen changes and periodically triggers the capture mechanism based on heuristic analysis of user interaction.

🔮 Future ImplicationsAI analysis grounded in cited sources

⏳ Timeline