Microsoft has not resolved one of Recall’s critical issues. The AI-powered “photographic memory” debuted a few weeks ago in a test version. Despite the months of delay and the promise to strengthen security measures, Recall has a key vulnerability.
According to a report from Tom’s HardwareRecall can capture your credit card detailseven when you activate protection filters. In an experiment carried out by its editorial director, Avram Piltch, the AI recorded and stored financial information. The data includes the full credit card number, expiration date and 3-digit security code (CVC).
Pitch designed an HTML form with fields that included the user’s personal information, including credit card. The author mentions that the form clearly indicated the phrase “credit card”, but Recall ignored it and captured the data. In another experiment, Pitch entered his social security number in a PDF and the AI also took a snapshot of it.
The report states that These failures occur even if the sensitive information filter is enabled. As a final piece of evidence, the journalist wrote the information on the plastic in a Notepad document specifying that it was a credit card. Again, Recall captured the information and stored it within the snapshot history.
Despite Microsoft’s changes, Recall still captures sensitive information
One of the reasons that delayed the launch of Recall has to do with the little attention that Microsoft paid to privacy. Activists pointed out the potential problems of capturing personal data during a session of this function. As if that were not enough, a cybersecurity expert discovered that snapshot history was stored in an unencrypted text document, raising concerns among people and regulators.
Months later and with several changes under the hood, Recall has been released for some Insider program userswho will serve as guinea pigs to test this version. Despite the privacy adjustments and the implementation of a confidential information filter, Recall not ready and requires more work.
The report of Tom’s Hardware suggests that the star function of the Copilot+ PC works half-heartedly. Blocking credit cards and other sensitive data applies to online stores, but not to forms, PDF files, or local documents.
On its help website, Microsoft mentions that sensitive information filtering is activated by default and prevents captures with personal data. The function also blocks official identification numberslike the DNI, driving license or tax identification number from Spain, as well as the CURP from Mexico.
“Sensitive information filtering is enabled by default and helps prevent passwords, national identification numbers, and credit card numbers from being stored in Memories. Sensitive information remains on the device at all times, regardless of whether Sensitive information filtering setting is on or off.”
Given the accusations of Tom’s HardwareMicrosoft mentioned that they are working to block credit card numbers and other sensitive data. Because Recall is in a testing phase, incidents are likely to occur like the one reported.
