Microsoft faces fresh Windows Recall security concerns

""My research shows that the vault is real, but the trust boundary ends too early.""

""This restricts attempts by latent malware trying to 'ride along' with a user authentication to steal data," said Microsoft in a September 2024 blog post."

A security researcher has developed TotalRecall Reloaded, a tool that extracts data from Microsoft's Recall feature, which faced significant criticism for cybersecurity issues. Microsoft redesigned Recall to enhance security, implementing a secure vault and requiring user authentication through Windows Hello. Despite these improvements, concerns persist regarding the effectiveness of the security measures. The researcher indicates that while the vault exists, the trust boundary is insufficient, suggesting vulnerabilities remain that could be exploited by malicious actors.

Read at The Verge