Slashdot Mirror
Windows 10's Biometric Security Layer Introduced
jones_supa writes: One of the major concepts of Windows 10 are new security ideas, and though Microsoft has touched on this topic before, it's only now giving us a more comprehensive look in the form of "Windows Hello." This is an authentication system that uses a variety of biometric signatures and combines hardware and software to allow for seamless and secure user recognition and sign-in. According to Microsoft, the ideal scenario here would be for you to simply look at or touch a new device running Windows 10 and to be immediately signed in. The software analyzes input from such hardware as fingerprint scanners and infrared sensors to make sure that you are you and not some impostor, and then signs you in without requiring you to enter a password. But the point of Windows Hello isn't only convenience, as the company's blog post notes, but also security. We've heard time and time again how insecure passwords are, and Microsoft is aiming to offer a widely-deployed replacement while still delivering enterprise grade security and privacy.
Considering I have heard tales of biometric scanners being bypassed by pressing a warm hot dog against them, I think I'll pass.
I'm sure they've improved, but I don't know that they've improved enough. Plus, I'm not sure I'd want to be auto-logged in by just picking up the device.
Will you have to retrain the mechanism to recognize you every time you switch from Brand A biometric sensor to Brand B? If so, it might not recognize you across devices anyway. It seems attractive in theory but I wonder how practical it will be in practice, since a typical user will have access to a variety of Windows devices at home and work.
Twinstiq, game news
I've seen cases recently where people crossing the border from one nation to another have been asked to enter their phone or laptop password for inspection. They are at this point free to refuse to divulge this information though there may be the obvious consequences. Using biometrics, would it not be possible for an attacker to simply force one to provide biometrics to unlock a device? What about other attacks such as a spouse unlocking a device using his/her partner's fingerprint while (s)he is asleep? I would think this would open up new security holes for the ones it fixes.
...in case you're in an accident and your hand is cut off, or your face needs to be reconstructed, or whatever else that could happen. That mechanism better be secure as well, and what will it rely on, another password?
Twinstiq, game news
Could they have picked a worse name? "Windows Hello" reminds me of all the awkward conversations I had with nontechnical Windows users about their "My Documents" folder. "Open My Documents." "Your documents?" "No, your My Documents." "My your documents?" "NO!..."
And the biometrics data hasn't have to be saved in clear anywhere, it can just be encrypted with a one-way crypto algorithm with the key to encrypt stored in the TPM. Then, the device collects the biometrics data, encrypt it with the key in the TPM and compare the resulting signature with the stored encrypted signature. If they match, you are the right guy, if not you are not authorized. Nobody can steal you biometrics data unless they temper with the hardware and introduce an hardware trojan horse. Getting the crypted data will not leak any useful information since it is equivalent to a very long password with very high entropy. A brute force method would take thousands years to crack it. And getting the key will not help since it is a one-way algorithm and the key is useless to decrypt.
Achille Talon
Hop!
Passwords are not a perfect solution, no one denies that. But overall, they are a good solution, especially when combined with something like and RSA key or Google authentication. Biometrics seems easier and more secure, and on the face it is. The issue with biometrics is that once there is a way around it, there is no way to change it. So you fingerprint is secure today. But tomorrow someone comes up with a way to fake your fingerprint. You are now stuck because you can't change you fingerprint. With a password, if it is hacked you can change it. With biometrics, if they are hacked you are entirely screwed because it can't be changed (which is the point of biometrics). Sorry, I'll stick with passwords for now.
"Information wants to be expensive" - Stewart Brand, the same guy who said "Information wants to be free"
I've been reading about biometric scanners for over a decade now, starting with the fingerprint reader bar that was on old IBM Thinkpads.
Every single attempt at cheap biometric security has been demonstrated to be insecure or unreliable. When I got my Lenovo laptop, the first thing I uninstalled was their camera-using face scanner software, because I'd read about how easy it was to hack with a photo of the person to be identified.
Sure, there are real biometric devices out there such as government iris scanners and such, but those are not cheap enough for mass deployment. Until such high reliability security devices are available to the consumer at a sane price, I'm going to stick with good old fashioned passwords.
Besides, getting into the machine is only the first step. All that would gain you access to is some personal photographs and documents. Everything else would require access to the keystore and the key passwords for accessing remote servers, so I'm still relatively comfortable that someone hacking my password isn't that great a risk.
I'm also perfectly comfortable with "da goobernmint" scanning my system (with a warrant), because all my "secure" data resides elsewhere, and they won't find so much as a PDF of a bank account statement on the box itself.
I do not fail; I succeed at finding out what does not work.
You long passwords and the biometrics all will sucumb to the $5 wrench attack, or the five year incarceration threat by government goon
How will I log into computers that customers bring to my store. How will I admin the hundreds of computers that see at customer locations?
"delivering enterprise grade security and privacy"
:)) So, good luck with all that :))
Somewhat offtopic: I'd so wish people would stop flinging this phrase around, like it would actually exist... That enterprise grade security has failed millions of people over the years, sometimes quite spectacularly. Adding a heuristic set of mixed-up unreliable biometrics won't change that, but it will make your life hell, when it fails (as it inevitably will). All that incorporated into an OS that likes to call home more often than an average person calls their Mom
I am putting myself to the fullest possible use, which is all I can think that any conscious entity can ever hope to do.
It sounds like a piece of shit.
Windows is a dying breed. Most of its usage is just old PCs in businesses trying to do what they have been doing for years. Is anyone really going to care about innovation that is based upon the Windows platform?