Slashdot Mirror
Microsoft Extends Its Windows Hello Login Security Features To Apps and the Web (techcrunch.com)
An anonymous reader quotes a report from TechCrunch regarding the beloved Windows Hello login security features: Microsoft is bringing to Windows apps (and even the web) some of the convenience and security of being able to use the same tech it uses to keep enterprise laptops safe. The idea here is to let you use the same technology that powers "Windows Hello" -- the login security feature of Windows 10 that supports fingerprint scanners, facial recognition and even iris scanners -- to log into other services, as well. This feature probably wouldn't be all that interesting if it only worked for Windows apps, but the company is also extending it to web apps. For now, this feature apparently only works with Microsoft's own Edge browser, but the company says it is compatible with the FIDO 2.0 standard and can theoretically work with any browser.
Hello Login sounds like a silly name for a cute little japanese cartoon character.
One of my many problems with Microsoft is the guilty-until-proven-innocent security model. Actually, they seem to have softened their position somewhat in recent years, but the perception remains, and whenever anything goes wrong with anything associated with Microsoft, one of the hardest possibilities to rule out is that I haven't done anything they perceive as a EULA violation.
Just a coincidence, but I ran into this last week. My employer recently announced we could upgrade to Office 2016. I wasn't brave enough to go first, but I was probably second in my section. Seemed to work okay for a couple of weeks, but then it died hard. Completely unusable. Lots of error codes leading to circular links on "support" webpages, but no discernible hint that the actual problem was a software conflict. I had to wildly guess that on the third day, but along the way there was at least one period where the software seemed to have lost its validation marbles. Some kind of ping pong between our corporate identity validation and Microsoft's? Not sure, but after I had solved the problem and thought everything was okay, I still received email with a new temporary account and password, apparently triggered during the period when the software thought it was invalid. (The attempt at recovery of the validation status must mean Microsoft now regards us as more of a major customer than a serious competitor? I think I'm sad.)
Anyway, mostly goes to prove my point that quality of the software is much less important than the cunning of the economic model. If Linux ever came up with a good one, Microsoft would be crushed. (Then again, maybe it's too late? Vista was SUCH a great opportunity...)
Freedom = (Meaningful - Coerced) Choice != (Speech | Beer^2), and sad sock puppets' bad mods avail them naught.
Does everything have to be a conspiracy?
BeauHD. Worst editor since kdawson.
Yes. The rules here are:
- Apple and Google are given cautiously wide berths and acceptance because they control everything now.
- Microsoft remains perpetually guilty until proven innocent.
- Mozilla is to be hated no matter what they do.
That's about the short and skinny of it. Free mod points to be had if you happen to have a standard copypasta "opinion" to share.
It's almost like Microsoft hosted an annual developers conference today an announced a bunch of news http://www.theverge.com/2016/3...
You go Microsoft! Jump that shark!
You want me to let a Microsoft browser send my "fingerprint scanners, facial recognition and even iris scanner" credentials across the open Internet as a whizzo convenience feature? (Checks calendar, nope it's only March 31)... Sure! Why not? What could possibly go wrong?
Are we trusting MS now? Between the "EVERYONE MUST HAVE WINDOWS 10" bs and Brad Smith saying we should let politicians decide what the balance is ( between encryption and personal freedoms ), I'm having a hard time with the whole notion that MS needs MORE of my security information, not less.
Maybe I'm just paranoid though. My tinfoil hat is probably 3 sizes too small.
Mod me down with all of your hatred and your journey towards the dark side will be complete!
Microsoft gets 6 free articles on the main page. Is this what slashdot is reduced to, shilling for the MICROS~1 organization?
I'm still waiting for someone to sell me a webcam that will work with Hello. There are a tiny number of laptops and tablets with one built in, but despite the technology being announced more than two years ago, there isn't a single stand alone camera that supports it. Supposedly Razer will be offering one in Q2, but no firm date. It doesn't really matter what apps the feature will unlock if no-one has the hardware to ever use it.
You're just jealous 'cuz the voices talk to *me*
I figure its the new PHB owners. No one has told them the truth about their lap tops yet. You know, where you hold the lap top upside down and shake it to reboot it.
Does anyone else not smile when in order to "open up" the operating system you have put your finger in a certain spot?
Hello is more flexible than the above suggests and this is really just an extension of their Single Sign On options. Microsoft really wants to push the PIN + something as better than a password (that users will just put on a post-it note and leave in their office). For low security locations, sure maybe just a IR scan of your face including vein locations heartrate and such = 1 factor (Hello only works with very specific and weird cameras), but most are going to implement it with biometric (face or fingerprint) + a PIN. Which arguably is better than a password that users have on a post-it note stuck to their monitor. Once you are initially logged in, the trust factor can reasonably be established as we already have a trusted token for your login and we can re-prompt for one factor just to make sure it's still the user at the keyboard, so we just reuse that token everywhere. This ties into stuff like their SSO for Office 365, SaaS apps and has a password manager to store other non-recognized apps. Basically what UPEK was doing in the early 2000's with their fingerprint software, but hopefully more secure.
Given Microsoft's history with being utterly incompetent at security, why would I trust them, or any other vendor, with biometric information? Why would I want a fucking app or a web page to have access to that stuff?
I'm sorry, but I neither believe this is any more secure, nor do I believe this isn't going to lead to huge unintended privacy violations or whatever damned server Microsoft keeps this shit on from either being hacked, or subpoenaed by big brother.
Sorry, but I'll pass on this shit. It serves no value for apps and web pages, and it's being offered by a company who I simply don't trust with the information or the implementation.
When this gets hacked, expect me to be quite loudly laughing and pointing.
Lost at C:>. Found at C.
If that doesn't scream "slashvertisedment" I don't know what does.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
True.
I would make one alteration:
- Microsoft remains perpetually guilty <strike>until proven innocent</strike>
My eyes reflect the stars and a smile lights up my face.
Security