Microsoft Recall fails to filter passwords and social security numbers
Microsoft's Windows Recall privacy filter reportedly fails to exclude passwords and social security numbers from screenshots, despite being enabled by default. Testing showed the filter inconsistently blocked sensitive financial and personal data.
What happened
Microsoft's Windows Recall, an AI app that screenshots user activity for searchable recall, includes a default 'Filter sensitive information' setting designed to exclude passwords and social security numbers from capture.
Testing by The Register found the filter fails in many cases. While it correctly excluded some financial data, account numbers, and most social security numbers, it captured screenshots containing bank account balances, deposits, and other sensitive pages despite the filter being enabled.
Reported impact
If an attacker gains access to a user's system or PIN number, including via remote access, they could obtain personal financial information, bank details, and other sensitive data captured in Recall's screenshots.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.