My company just mandatorily implemented “Windows Hello”

No one seems to be able to tell me why the information from Microsoft says the fingerprint and face scans are both “local only” and may take 24 hours to sync after initial setup. Where are they syncing to?
(I opted for the ‘pin’ method instead of surrendering my biometrics.)

I could accept that it has to do with azure propagation delays, but the verbiage was explicit about our computers syncing to the tenant. (Vs. data propagating across it.)

I sort of reject the idea that there’s nothing nefarious going on. The misdirect is weird.

Unless they’re salting the hashed data with information they can’t access, they’re just creating a database of faces and fingerprints.
Sure, maybe if their cryptography is good the DB cannot be reversed but they can still use an unsalted database to give match/no match info on scans of faces and fingerprints submitted to it.
But also, I firmly don’t trust Microsoft. They’ve violated our ELA several times - mostly around applying analytics tools to our data without consulting us first. (Like rolling out MS Viva without telling us.)

…. Oh!

You just explained a question I had.
I couldn’t figure out why a pin was considered more secure.

In my reasoning: How is a PIN (potentially numeric only), changed 1x a year, safer than a password (3 of 4: Alpha, Mixed case, numeric, special chars), changed 4x a year.

The answer, as you explained, is scope of trust. Machine only vs tenant-wide. That makes sense.

The average normie has no clue what privacy is.

“Why wouldn’t I use verification? I’ve got nothing to hide”.

This. This is why you do not submit willingly, regardless of what you have to hide. Fascism doesn’t give a shit if you’re innocent.