Tom Warren: Windows AI feature that screenshots everything labeled a security ‘disaster’

Despite Microsoft’s promises of a secure and encrypted Recall experience, cybersecurity expert Kevin Beaumont has found that the AI-powered feature has some potential security flaws. Beaumont, who briefly worked at Microsoft see in 2020, has been testing out Recall over the past week and discovered that the feature stores data in a database in plain text. That could make it trivial for an attacker to use malware to extract the database and its contents.

I was pretty positive on this feature when it was announced last month. In that piece I commented on how the feature could feel insecure even if it was very well locked down, but I didn’t anticipate the feature would be so insecurely implemented. If there are security professionals who have looked at how this is done and gone, “this is good, actually,” I haven’t found them.