MICROSOFT RECALL SCREENSHOTS CREDIT CARD NUMBERS AND SOCIAL SECURITY NUMBERS

Summary from the TLDR InfoSec newsletter

The author of this post was investigating the efficacy of Microsoft Recall's “sensitive information” filter, which comes enabled by default in the current Windows Insider build, and found that it still captured credit card information and SSNs. The researcher tested entering credit card numbers into a Notepad file with clear text delineating it as a credit card number, filled out a PDF of a loan application in Microsoft Edge that included an SSN and other personal information, and even created an HTML page that had a text input explicitly requesting credit card information and found that Recall copied all of them. Recall did omit capturing information inputted in actual shopping sites though.