With all due respect to Zac — who is an excellent writer and makes some good points in his article — I really feel as though it skims over the real concerns, so I just want to critique a couple points he makes.
“…the snapshots and strings of text that Windows Recall logs are safely encrypted on your PC using Device Encryption and Bitlocker. This means if your laptop is ever stolen, intruders can’t access the contents of your storage without an encryption key, and they won’t be able to gain access to any stored snapshots without being logged in to your account.”
While this may be true, encryption does not equal secure. (And a point I’m going to address in a second entirely calls into question the security of the feature at all.) Even so, if you’re actively looking at Recall information and you unknowingly have malware or a targeted virus on your computer, you’re screwed! Oh, and if you hit share on a Recall thing, all someone has to do is eyeball your “C:\Users[username]\AppData\Local\Temp” folder, and boom, they have that information.
Thankfully, Zac does agree that malware may be a problem. Which is good! That’s a main concern amongst pretty much everyone right now.
The entire Windows Recall experience is processed on device, which is partly why it requires a Copilot+ PC to function. Microsoft is offloading the resources required to process a feature like this onto the NPU, which is a secure chip that’s powerful enough to handle the processing of snapshots using AI with little power draw.
This means Windows Recall works 100% offline, and you don’t need an active internet connection to take advantage of it. It doesn’t even require a Microsoft Account, and as a result is missing some quality of life features such as cross-device syncing. None of that is possible here, because Windows Recall does not upload your data anywhere.
It was recently discovered that Recall works completely fine without any real issue on devices without NPUs, including systems with Intel/AMD processors (though a few dependencies are obviously missing on x86_64 systems.) So whilst the claim that it “requires” a Copilot+ PC to function correctly, that only really means “out of the box.” You can get it working on other PCs, and that’s the real concern.
Additionally, Recall is not discriminatory about what sort of information it’ll grab. Microsoft themselves have warned it will grab your passwords and banking info. The discrimination feature seems to be integrated fairly well into private browsing on many of the popular web browsers.
And let me raise you this question: who’s going to use that to check their bank statements or make a purchase every time? Or even use Edge at all, for that matter? Sure, Edge has gotten better since switching to Chromium, but it’s still a bloated piece of trash that hardly anyone trusts, so I’m not entirely convinced it’s a great substitute.
And yes, you can exclude certain apps and websites from showing up in Recall at all, but I don’t trust Microsoft to respect the damn settings. I mean, the company has shown they don’t respect your default browser (hell, they’ve probably stolen your data without you even knowing). They shove ads down your throat in an operating system you paid for.
The UK, by the way, is currently launching an investigation into this Recall feature. While it’s unclear why, it’s probably due to all of the concerns raised by users like me, as well as literal cybersecurity professionals. In an interview with SC Media, Patrick Tiquet, VP of Security & Architecture at Keeper Security said:
“Microsoft’s Recall feature raises a few alarms, including security risks of potentially capturing and store detailed and sensitive information, as well as concerns surrounding invasion of privacy. The potential of sensitive information being stored without proper security protocols, puts your cybersecurity and even your identity risk.”
Even the malware protection giant themselves, Malwarebytes, chimed in on Twitter with their own thing:
Encryption, even with the popular BitLocker tool, simply aren’t enough to quell people’s concerns. Even barring the concerns, this feature has some serious privacy and security implications. Can Microsoft, a company known for not caring about user choice (see: Edge forcing itself down your throat, Microsoft not letting you change default browsers easily or uninstall Edge at all, etc.), really be trusted to handle something like this?
For people like me, who are well-versed enough to know when to sound the alarm and jump ship: this is that time, and we are. I already have, I’m writing this on Pop!_OS, actually. I’ve returned home to Linux for the first time since switching to Windows in 2014 and macOS in 2016. (Though I still use macOS, of course!) I simply refuse to let Microsoft tell me how to use my computer, dictate what browser, search engine, and apps I use on my computer.
Freedom, privacy, and security matter. I will use 1Password, I will use Firefox, I will use whatever the hell default programs I feel like on my computer. Everyone should have that freedom. End of story.
I stand behind my claim that Windows 11 is just one of many nails in Microsoft’s coffin. It’s, in fact, a data-collection beast. It’s phoning home to Microsoft, even if you tell it not to. Microsoft is simply masquerading as a hardware/software giant, when it’s actually one of the most successful advertising powerhouses on the planet.
Why? Because we, the people, believed many of their past lies, and went along with it. Because Windows is “easier” to deal with than Linux (you have a point, but it’s getting easier with distributions like Pop!_OS.) Because games “just work” on Linux (Valve and the Steam Deck are changing this with Proton.)
So yeah, I can confidently say that Windows is spyware pretending to be “The best Windows yet.” And Microsoft? It’s 100% spyware, let’s just call it what it is. There’s no debate here to be had, either, I think it’s fairly well known that the telemetry is awful and only gets worse as the years go on.
That’s why I don’t trust Recall or anything that comes out of Microsoft anymore. That’s why you shouldn’t either. Be skeptical. And if you can (not everyone can), leave Windows behind. Go to a Mac, if you really don’t want to touch Linux. Just run away.