Microsoft faces fresh Windows Recall security concerns (www.theverge.com)

Microsoft's AI-powered Windows feature, Recall, designed to capture and store user activity, is once again under scrutiny due to security vulnerabilities. After considerable backlash deemed it a "privacy nightmare," Microsoft redesigned Recall, incorporating stronger security measures such as a secure vault, Windows Hello authentication, and a Virtualization-based Security Enclave. However, security researcher Alexander Hagenah has unveiled a tool, TotalRecall Reloaded, that can extract sensitive data from Recall, raising alarms about the feature's integrity. Hagenah asserts that while Microsoft's redesign did create a secure environment, the trust boundary has significant weaknesses that allow for potential exploits. Recall retains extensive user information beyond simple screenshots, including text history, emails, and browsing details. Hagenah's findings suggest that malicious software can leverage the authentication process to access Recall data, effectively bypassing the intended security measures. Despite Microsoft's reassurance that their protections prevent such vulnerabilities, Hagenah contests that the architecture fails to adequately safeguard against potential abuses from malware. While Microsoft has acknowledged Hagenah's research, deeming it consistent with existing security protocols, experts like Hagenah emphasize the need for further strengthening of the security model to fulfill Microsoft's original promises regarding data protection within Recall, as the system currently exposes users to significant risks.