Recall: Stealing everything you've ever typed or viewed on your own Windows PC
Microsoft’s new “Recall” feature for Windows, which continuously screenshots and OCRs a user’s activity to create an AI-searchable history on the local machine, is being framed as a productivity boost but is widely seen as a profound privacy and security risk. Commenters note that the data is stored in an easily exfiltrated local SQLite database, making it a high‑value target for malware, abusers, employers, and law enforcement, especially given Microsoft’s track record with dark patterns and forced updates. The backlash feeds into broader concerns about OS‑level surveillance, ad‑driven business models, and the erosion of user control, with many pointing to Linux and older, simpler systems as safer alternatives.
Overall reaction
- Many see Recall as a “disaster‑class” feature: invasive, tone‑deaf, and indicative of a deeper shift away from user control.
- A minority argue it’s overblown: malware or admins could already monitor users; Recall mainly centralizes what’s already possible.
Security & malware implications
- Core worry: a single local SQLite “lifelog” becomes a jackpot for infostealers and other malware.
- Commenters note BitLocker only encrypts data at rest; once logged in, the Recall DB is plaintext and easily exfiltrated.
- Example given: off‑the‑shelf infostealer exfiltrated Recall data before Defender’s automated remediation reacted.
- Others counter that attackers can already grab emails, docs, browser data, etc.; debate centers on incremental risk of a comprehensive, searchable record.
Privacy, abuse, and surveillance concerns
- Fear of “total recall” of everything on screen: porn, banking, private chats, telehealth, legal consultations, sensitive work.
- Particular concern for domestic abuse and coercive control: abusers gaining hindsight visibility into victims’ attempts to seek help.
- Anxiety that this normalizes OS‑level surveillance, not just optional apps.
Opt‑in, defaults, and trust in Microsoft
- Anger that Recall is enabled by default on new Copilot+ PCs and not cleanly disabled during setup; fears of the usual pattern: opt‑in → default‑on → hard/ impossible to disable.
- Widespread distrust due to past telemetry, ads, forced updates, re‑enabling of “optional” features, and mandatory Microsoft accounts.
- Some view this as deliberate Overton‑window shifting: launch at “11,” walk back to “9,” still far beyond previous norms.
Comparisons to other tools & platforms
- Similar “rewind”/lifelogging apps (often open source, opt‑in, or paid) were previously accepted; people trust Microsoft less and dislike OS‑level, default logging.
- Some argue Apple could ship a similar feature and be better received if framing and security story were stronger; others dispute that.
- Several see this as further incentive to move to Linux or, for games, consoles.
Legal, corporate, and societal angles
- Expectation that enterprises will eventually enforce Recall (e.g., via Intune) and use AI summaries for employee monitoring.
- Anticipation of major consequences in litigation and e‑discovery: Recall logs as “new text messages/browser history.”
- Broader theme: ongoing erosion of privacy, user agency, and “open computing” in favor of ad‑driven and AI‑driven business models.