My company just mandatorily implemented “Windows Hello”
No one seems to be able to tell me why the information from Microsoft says the fingerprint and face scans are both “local only” and may take 24 hours to sync after initial setup. Where are they syncing to?
(I opted for the ‘pin’ method instead of surrendering my biometrics.)
PIN is the best way to go there.
It only works on that one machine, although you can technically set the same PIN again on another computer.
I believe the typical intent is as follows:
It is now possible to brute force things that were previously considered “complex” passwords in a semi-reasonable amount of time.
This necessitates longer and more complex passwords
People can’t remember those so they have a tendency to write them down or do other relatively insecure things with them.
Forgotten passwords can generate a lot of helpdesk calls and are also an attack vector
If we insist on really complex passwords that are too long to reasonably brute force with current technology, we need a way for users to log in that’s not going to make 3 and 4 a major issue.
If the simpler PIN method is locked to a per machine basis, it matters a lot less if the PIN is compromised because you also need physical access to the computer or the PIN is useless.
This should, in theory, allow workplaces to set requirements for really complex passwords that only need to be reset once a year or so, without breaking helpdesk, inconveniencing users, or leaving gaping security holes.
Whether or not that all happens depends on the workplace, but that’s the general thought process in most of the places I’ve worked where a modicum of sense prevails
You just explained a question I had.
I couldn’t figure out why a pin was considered more secure.
In my reasoning: How is a PIN (potentially numeric only), changed 1x a year, safer than a password (3 of 4: Alpha, Mixed case, numeric, special chars), changed 4x a year.
The answer, as you explained, is scope of trust. Machine only vs tenant-wide. That makes sense.
That makes sense. Something you have (that specific machine) + something you know (your pin).
I used to work someplace where we all had a pin+a smart card that we’d insert into the machine, same idea except I could log into any machine with the card+pin combination.
Loved not having to remember a long AF password. Didn’t like having to drive home if I forgot my card on the kitchen counter.
Windows Hello ties the PIN to the TPM of the computer. It’s not just you having a pin, its the pin + the crypto secret loaded on the device. Thats why its more secure then just a complex password.
My assumption is that they are recorded locally, then hashed, then the hash is sent to Azure (Microsoft cloud) as Windows Hello leverages some cloud features. Some things in Azure have warnings about taking up to 24 hours to take effect.
Hashing locally and sending the hash to a server is the same way all passwords for online services and systems work, so nothing nefarious there.
There’s probably perceptual hashing so they can count 95% similarity as a match without having to check against the source material every time.
I could accept that it has to do with azure propagation delays, but the verbiage was explicit about our computers syncing to the tenant. (Vs. data propagating across it.)
I sort of reject the idea that there’s nothing nefarious going on.
The misdirect is weird.
Unless they’re salting the hashed data with information they can’t access, they’re just creating a database of faces and fingerprints.
Sure, maybe if their cryptography is good the DB cannot be reversed but they can still use an unsalted database to give match/no match info on scans of faces and fingerprints submitted to it.
But also, I firmly don’t trust Microsoft. They’ve violated our ELA several times - mostly around applying analytics tools to our data without consulting us first. (Like rolling out MS Viva without telling us.)
My company just mandatorily implemented “Windows Hello”
No one seems to be able to tell me why the information from Microsoft says the fingerprint and face scans are both “local only” and may take 24 hours to sync after initial setup. Where are they syncing to?
(I opted for the ‘pin’ method instead of surrendering my biometrics.)
PIN is the best way to go there. It only works on that one machine, although you can technically set the same PIN again on another computer.
I believe the typical intent is as follows:
This should, in theory, allow workplaces to set requirements for really complex passwords that only need to be reset once a year or so, without breaking helpdesk, inconveniencing users, or leaving gaping security holes.
Whether or not that all happens depends on the workplace, but that’s the general thought process in most of the places I’ve worked where a modicum of sense prevails
…. Oh!
You just explained a question I had.
I couldn’t figure out why a pin was considered more secure.
In my reasoning: How is a PIN (potentially numeric only), changed 1x a year, safer than a password (3 of 4: Alpha, Mixed case, numeric, special chars), changed 4x a year.
The answer, as you explained, is scope of trust. Machine only vs tenant-wide. That makes sense.
That makes sense. Something you have (that specific machine) + something you know (your pin).
I used to work someplace where we all had a pin+a smart card that we’d insert into the machine, same idea except I could log into any machine with the card+pin combination.
Loved not having to remember a long AF password. Didn’t like having to drive home if I forgot my card on the kitchen counter.
The problem is, if someone does get physical access to the machine, you’ve just made breaking into it much easier.
Edit: that’s assuming the smart card is using rfid.
Just keep the card in your anus
Windows Hello ties the PIN to the TPM of the computer. It’s not just you having a pin, its the pin + the crypto secret loaded on the device. Thats why its more secure then just a complex password.
My assumption is that they are recorded locally, then hashed, then the hash is sent to Azure (Microsoft cloud) as Windows Hello leverages some cloud features. Some things in Azure have warnings about taking up to 24 hours to take effect.
Hashing locally and sending the hash to a server is the same way all passwords for online services and systems work, so nothing nefarious there.
There’s probably perceptual hashing so they can count 95% similarity as a match without having to check against the source material every time.
I could accept that it has to do with azure propagation delays, but the verbiage was explicit about our computers syncing to the tenant. (Vs. data propagating across it.)
I sort of reject the idea that there’s nothing nefarious going on. The misdirect is weird.
Unless they’re salting the hashed data with information they can’t access, they’re just creating a database of faces and fingerprints.
Sure, maybe if their cryptography is good the DB cannot be reversed but they can still use an unsalted database to give match/no match info on scans of faces and fingerprints submitted to it.
But also, I firmly don’t trust Microsoft. They’ve violated our ELA several times - mostly around applying analytics tools to our data without consulting us first. (Like rolling out MS Viva without telling us.)