Windows Recall (was) a Security Nightmare
Source: YouTube · John Hammond · published Jun 8, 2024 · 37:06
Microsoft's Recall feature constantly captures screenshots of everything users do on their computers, creating searchable records but raising significant privacy and security concerns 0:10-0:20.
Key Takeaways:
• Recall stores all data in plain text SQLite databases and unencrypted JPEG files, making it easily accessible to anyone with system access 7:00-7:36
• Security researchers demonstrated how simple it is to extract all stored data using tools like the "Total Recall" Python script 12:47-13:14
• Due to public backlash led by security researcher Kevin Beaumont, Microsoft announced changes making Recall opt-in with Windows Hello authentication 20:45-21:16
• Even with improvements, threat actors could potentially enable Recall remotely to collect sensitive information over time 19:34-19:47
The security community's successful pushback demonstrates the importance of holding tech companies accountable for privacy and security in AI features 36:02-36:16.
Sources:
- 0:10-0:20 Introduction to Recall feature
- 7:00-7:36 How Recall stores data unencrypted
- 12:47-13:14 Total Recall extraction tool demonstration
- 19:34-19:47 Security risks even after changes
- 20:45-21:16 Microsoft's announced security improvements
- 36:02-36:16 Community impact on Microsoft's decisions
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
by now you've probably seen this video how do we introduce memory right photographing memory into what you do on the PC and now we have it so it's called recall it's not keyword search right it's semantic search over all your history and this video it's constantly taking snapshots in the background of everything you do on your computer and this video Microsoft recall a new AI tool by Microsoft is one of the biggest mistakes in terms of privacy that I've ever heard of in the history of computing in this video too today let's hack Microsoft's crappy recall feature and all of these videos talking about Windows recall everyone has been talking about recall for the past couple of weeks and here I am ready to cash in my internet points with my attempt to chat about recall so with this video I'd …