Home | Notifications | New Note | Local | Federated | Search | Logout
Note Detail
Reply to @GossiTheDog@cyberplace.social
Kevin Beaumont@GossiTheDog@cyberplace.social (2026-01-20 06:27:16)
Microsoft are upselling security controls for Microsoft Recall, which allow orgs to limit what it records specifically - if the org pay for Microsoft Purview.
I’ve had a look at how this works under the hood, it is using undocumented features in Recall. https://learn.microsoft.com/en-us/purview/dlp-recall-get-started
---Attachments---
image: https://cyberplace.social/system/media_attachments/files/115/923/872/405/480/668/original/f1e8f29ac6750d23.jpeg
---Reply---
Kevin Beaumont@GossiTheDog@cyberplace.social (2026-02-03 08:35:43)
Microsoft is reviewing its Copilot+ integrations, and is saying internally that Microsoft Recall has failed.
https://www.windowscentral.com/microsoft/windows-11/microsoft-is-reevaluating-its-ai-efforts-on-windows-11-plans-to-reduce-copilot-integrations-and-evolve-recall
Reply
---Replies---
Kevin Beaumont@GossiTheDog@cyberplace.social (2026-03-12 00:56:58)
So @xaitax has cracked Microsoft Recall, he's got access to the encrypted database and has automated dumping of screenshots and all text from screenshots.
I've looked at most recent Recall and yep, you can just read the database as a user process. The database also contains all manner of fields which aren't publicly disclosed for tracking the user's activity.
No AV or EDR alerts triggered, world's #1 in infostealer 😅
* you can just read it in plain text
---Attachments---
image: https://cyberplace.social/system/media_attachments/files/116/211/332/204/118/791/original/31da14ad88d5de85.png