Microsoft Moves Windows 10 Closer To A Future Without Passwords (forbes.com) 224
"Microsoft has very quietly confirmed the death of Windows 10 passwords this week," claims Forbes -- though I think they may be overstating things a bit:
Microsoft's crypto, identity and authentication team group manager, Yogesh Mehta, has made an announcement that he says puts "the 800 million people who use Windows 10 one step closer to a world without passwords...."
Mehta confirmed that with the release of the forthcoming Windows 10 May update, Windows Hello becomes a fully FIDO2 certified authenticator... [Windows Hello is "a biometrics-based technology that enables Windows 10 users to authenticate secure access to their devices, apps, online services and networks with just a fingerprint, iris scan or facial recognition."]
So does the arrival of FIDO2 certification for Windows 10 mean that passwords are now dead? Not quite. The death of the password for Window 10 could yet be a lingering and painful one. "We encourage companies and software developers to adopt a strategy for achieving a passwordless future and start today by supporting password alternatives such as Windows Hello," Mehta says, before admitting that to arrive in this future requires "interoperable solutions that work across all industry platforms and browsers."
I say painful, by the way, as there will no doubt be no shortage of stories about password security fails until the final nail is hammered into this authentication coffin.
Mehta confirmed that with the release of the forthcoming Windows 10 May update, Windows Hello becomes a fully FIDO2 certified authenticator... [Windows Hello is "a biometrics-based technology that enables Windows 10 users to authenticate secure access to their devices, apps, online services and networks with just a fingerprint, iris scan or facial recognition."]
So does the arrival of FIDO2 certification for Windows 10 mean that passwords are now dead? Not quite. The death of the password for Window 10 could yet be a lingering and painful one. "We encourage companies and software developers to adopt a strategy for achieving a passwordless future and start today by supporting password alternatives such as Windows Hello," Mehta says, before admitting that to arrive in this future requires "interoperable solutions that work across all industry platforms and browsers."
I say painful, by the way, as there will no doubt be no shortage of stories about password security fails until the final nail is hammered into this authentication coffin.
Good luck. (Score:5, Insightful)
" that enables Windows 10 users to authenticate secure access to their devices, apps, online services and networks with just a fingerprint, iris scan or facial recognition."
My PC had no hardware capable of these functions, nor will it ever.
Re: (Score:3)
fingerprint, iris scan or facial recognition."
My PC had no hardware capable of these functions, nor will it ever.
No camera at all? Still, if your government wants your iris scan, they could get it through an eye exam at the DMV.
Re:Good luck. (Score:5, Interesting)
Black PVC tape over the camera and it is going to stay. Sorry MS. Also, do not forget that you cannot change fingerprints, iris or face when they get compromised. And they will, rest assured of that. No thanks, I will stay with my passwords. The only ones ever compromised have been for an unimportant account, several years after it was terminated.
Re:Good luck. (Score:5, Informative)
There are, of course, "gummy fingerprints". The technology to beat most fingerprint scanners has been easily available for decades.
https://www.theregister.co.uk/... [theregister.co.uk]
Re:Good luck. (Score:5, Informative)
It is even worse:
https://www.zdnet.com/article/... [zdnet.com]
You are an idiot. Seriously. No clue, no research done, big mouth spewing nonsense.
Re: (Score:2)
Begging your pardon, but it seemed a reasonable question to me. I've not tried one, personally, since shortly after the original vulnerability was published. Has anyone seen any evidence that the fingerprint readers have improved in any noticeable way, especially on portable devices?
Re: (Score:2)
They haven't, they really can't. Yes, better ones exist, but they're too expensive to be embedded in a cheap laptop, external reader or mobile device. When you have to deploy 15,000 of these things in a small-medium company, a $25/p difference is huge and any of them, regardless of how ineffective, allows you to check all the boxes for . Hence why we still have 'encrypted USB' devices that are nothing but a plugin board that electrically locks out a standard, regular USB or hard disk device.
Re:Good luck. (Score:5, Informative)
An idiot I may be. However, I do claim to have a clue, with half-a-dozen patents to my name in the field of Biometrics and Fingerprint Sensors.
The article you link to suggests a technique that allows creating a spoof fingerprint that works 23% of the time - when the false match rate is set to 0.1%. The industry standard false match rate is generally between 0.01% and 0.0001%, depending on security settings. I'm not too concerned. They're also completely silent on the matcher algorithm being used - algorithms from 10 years ago were notoriously easy to spoof; algorithms today are much, much harder to spoof.
To have a competitive fingerprint sensor in the market today, you have to be able to demonstrate resistance to a dozen or more methods of creating spoofs - gummi bears among them. And despite reports, building the spoofs is a sophisticated art that requires practiced technique and does not scale - the ability to build a spoof doesn't imply the ability to build 10,000 spoofs.
So, please crawl back under your rock and let the adults have a conversation here.
Re:Good luck. (Score:4, Interesting)
You might have a point, you might not, but do you know how many patents Theranos was granted?
The USPTO doesn't really work as an appeal to authority.
Re: (Score:2)
Black PVC tape over the camera and it is going to stay.
"Samsung is working on ‘perfect full-screen’ devices with selfie cameras under the display" "The S10’s hole-punch display is just the start" "Samsung is working on making the entire front of its phones a screen, with no need for bezels or a camera cutout of any kind. Yonhap News Agency reports that the company’s vice president of its display R&D group, Yang Byung-duk, said that “though it wouldn’t be possible to make (a full-screen smartphone) in the next 1-2 years, t
Re: (Score:2)
I will just not buy that crap then. Your point?
Re: (Score:2)
My custom built decade old desktop PCs don't have cams and mics. I'm not planning to get them too. ;)
Biometrics are more of a username than a password (Score:2)
Facial Reognition or an Iris Scan is great for replacing a username.
But it shouldn't be the "secret" part of a login
Re: (Score:2)
Black PVC tape over the camera and it is going to stay.
There's a big difference between a computer not being capable and a computer being willfully defeated by its user.
Re: (Score:3)
Re: (Score:2)
That is exceptionally unlikely. You are clueless on a really fascinating level.
Re: (Score:2)
My PC had no hardware capable of these functions, nor will it ever.
Eventually every PC monitor and TV will come with inbuilt camera thats literally inside the screen and therefore cannot be taped over.
Re: (Score:2)
My PC had no hardware capable of these functions, nor will it ever.
Eventually every PC monitor and TV will come with inbuilt camera thats literally inside the screen and therefore cannot be taped over.
Every LED is also a weak photodiode.
Luckily they can only capture a few frames per second, or you'd be able to see the flickering, since the LED has to be off to use it in reverse.
It isn't enough to cover visible lenses. You also have to live inside a Faraday cage, and say no to backlit screens, OLED screens, and CRTs.
Re: (Score:2)
Re: (Score:2)
Damn right.
Re:Good luck. (Score:4, Informative)
Re: (Score:2)
Thinkpads have a physical cover you can slide over the camera, but it doesn't disable the microphone.
Re: (Score:2)
Re: (Score:2)
Most desktop CPUs don't have one built in.
What's a desktop PC? Is that one of those things that gamers and neckbeards use?
Re: Good luck. (Score:2)
No, it does not have a webcam.
Re: (Score:2)
No one expects your 90s era computer to have a webcam. Good luck buying something modern without one though. Or let me guess, you're going to be one of those strange people who get this "desktop" thing that I read about in a computer museum.
Re: (Score:3)
My PC has no camera unless I plug one in. It also has no audio input device unless I plug one in. This is still standard for desktop PCs.
Re: (Score:2)
Why would I buy a device that I not only have no use for but would actually pay to not have to use it?
Re: (Score:2)
No one buys a webcam. They just exist magically when their old laptops die and they realise that no laptops these days come without one.
Wait ... are you one of those weird "desktop" users? I read about those in the history books one day. How strange times must have been that people didn't carry their computers around with them and were forced to use them at their desks.
Re: (Score:2)
Re: (Score:3)
When (not if) Windows security is compromised, you don't have the option of replacing your fingers, eyes or face with new ones.
You might be underestimating what Microsoft are capable of doing to you.
Re: (Score:2)
What about that device you carry around in your pocket 16x7?
A dumb phone from 2009? What about it? Or my rooted verizon tablet that is with me sometimes?
Re: (Score:2)
Yeah, I mean, who could possibly fit a laptop and a phone? You're going to have to make some hard choices for this lifestyle. You might not even have room for a Model M keyboard.
Re: (Score:2)
As this evolves we will.... (Score:2)
notice a rise in quality and spectrum of Halloween masks. At least till they pass a law...
Re: (Score:2)
In my religion, covering up your identity is mandatory for it shows your deep respect to the (insert deity of choice here) and other people because it means you don't consider yourself special enough to warrant an identification.
Are you prosecuting my religion?
How does it replace (Score:3)
Something you know, in the usual three (a thing you know, a thing you are, and a thing you have)?
Re: (Score:3)
At the moment most people just use a single password. For Windows, for dozens of websites, for all sorts of stuff. So for them this is an upgrade.
What I really want to see is the ability to use tokens to log in. A Yubikey or my phone via NFC would be good.
Re: (Score:2)
Re: (Score:2)
Only with their app, and only by plugging in USB rather than just NFC.
It needs proper support for the open standard so that everything works.
Re: (Score:2)
I will investigate, thanks. It wasn't possible previously, would be nice if you could do it now. Finally a decent use for the NFC reader in laptops.
Re:How does it replace (Score:4, Insightful)
At the moment most people just use a single password. For Windows, for dozens of websites, for all sorts of stuff. So for them this is an upgrade.
Replacing one single password with a different form of a single permanently unchangeable password for Windows, dozens of websites, for all sorts of stuff is a downgrade that makes a bad situation much worse.
What I really want to see is the ability to use tokens to log in. A Yubikey or my phone via NFC would be good.
Until the key breaks or is lost or stolen never to be seen again.
Expecting users to manage physical keys is a taller order than expecting users to remember and or write down passwords.
If you look at the mass market for things like MFA being sold as improved security.. in real world deployments that selling point never materializes. These measures don't improve security as deployed. What they actually do is provide a means of resetting a forgotten password or replacing a lost or broken key effectively reducing security. Countless billions are lost yearly in "I forgot my password" and that's really the selling point for these systems not security.
If people really gave a shit about outcomes and improving security for everyone they would stop with adhoc login forms peppering every website and web application on earth and instead use secure authentication algorithms rather than plaintext over TLS which unnecessarily turns the web into a phishers paradise.
It's rather comical that people systematically fail to deploy proper security and then blame passwords as the root of all evils. It's nothing more than bankrupt marketing trash.
Re: (Score:2)
Replacing one single password with a different form of a single permanently unchangeable password for Windows, dozens of websites, for all sorts of stuff is a downgrade that makes a bad situation much worse.
That's not how it works. The tokens can be replaced as often as you like. If one is compromised just generate another. If your fingerprint is compromised the attacker still needs your particular phone or computer that has the token on it, so remote attacks e.g. on corporate network accounts don't work.
Until the key breaks or is lost or stolen never to be seen again.
Obviously you must have a backup way to gain access. Typically a long recovery key, generated by the machine, that either the IT department keeps track of or you can store securely yourself somehow.
You have to
Re: (Score:2)
Then facial recognition will make the matter worse, because then not some, not many but ALL people will use the same face for all websites.
Re: (Score:2)
No because your face doesn't get sent to the web site. A token gets sent, and the token is unique to the site and the computer. The site never gets near your authentication method, in this case an image of your face.
Re: (Score:2)
It doesn't replace three. It replaces one, through another using authentication in between. I.e. your multitude of passwords are replaced with a biometric authenticator that bypasses the passwords for you.
No you won't find Windows Hello securing the NSA vault. Would make it a lot more secure though than having every website permanently logged in through cookies though.
I have only two irises (Score:4, Funny)
Re: (Score:2)
Yeah, I think this is a big problem.
When you’re unlocking your personal devices, you can state that device is the “something you have” and your biometric attribute is the “something you are”, since you have control over the circumstances and the local environment. But translating that out to websites doesn’t really work in a non-spoofable manner - at least, I can’t see myself being comfortable with assurances from some company (be it Microsoft or someone else) that
Re: (Score:2)
Just guessing, but I'd expect in the future for them to use some sort of X.509 signing to identify you to websites. Browsers already support that, and the MS browser would then manage it for you as part of your Windows identity.
This is great for MS because if you don't keep your OS subscription current, now you can't log into any websites until you either renew, or learn how to computer.
Re: (Score:2)
Re: (Score:2)
What iris do I use on the third site I want to log in to?
The same one you use for all your other varied and completely independent identities. You may want to read up on what FIDO2 is and how it works.
Re: (Score:2)
Re: (Score:2)
Fido is an industry standard. It's of course possible that Microsoft managed to bungle the implementation (accidentally or otherwise) _and_ get that bungled implementation through Fido certification.. but they can only take that so far if they want to remain compatible with third party Fido systems (MS may not care about using external authentication dongles but they probably would _love_ to be able to act ass an authenticator themselves,) and of course would lose their certification if they got caught, wh
Re: (Score:2)
And that affects an open industry standard that doesn't pass tokens that cross identify you between instances how?
Re: (Score:2)
It doesn't work like that. Your iris is never sent to the site.
The site generates a token that your browser stores, and only sends for login when it has authenticated you locally.
Re: (Score:2)
It doesn't work like that. Your iris is never sent to the site.
The site generates a token that your browser stores, and only sends for login when it has authenticated you locally.
When number of devices exceeds number of eyeballs?
Re: (Score:3)
The brown one in the back.
Black-hats are rejoicing! (Score:4, Insightful)
Because whatever will replace passwords on win10 will surely be an insecure mess. And, unlike passwords, the user cannot increase security anymore by choosing a good password. Biometrics? Easily compromised and what do you do if your face/fingerprint/voice is public knowledge? Plastic surgery?
At this time, passwords are the best thing we have, and adding a second factor like a smartcard makes them pretty secure. Nothing else comes even close.
Re: (Score:2)
But , but, cool tech, AI , buzzwords!! Who cares about actual security when you can spout off headline grabbing BS that puts up the share price?
Re: (Score:2)
Hehehe, exactly.
Re: (Score:2)
Indeed. Insecure-on-demand.
How about... (Score:5, Insightful)
No.
Re: (Score:2)
Thanks for your helpful response.
Regards
"Hackers" who know that everyone's password is 12345.
Surveillance state (Score:5, Insightful)
Yet another step toward universal surveillance in the ongoing attempt to make it impossible to do anything without being tracked. Once the majority of users are on a system that verifies ID at a low level, it will be easy for sites to prohibit access to anyone who doesn't provide that sort of identification.
I'm not claiming some great "conspiracy", just that personally identifiable information is valuable and consumers don't have a lot of leverage to push back against it. (sure individuals can elect not to use products that require bio metric identification, but those options will gradually disappear.
Once this set of databases exists, I think its only a matter of time before it is misused in a dramatic fashion.
Re: (Score:2)
Yet another step toward universal surveillance in the ongoing attempt to make it impossible to do anything without being tracked.
Yet another example of people commenting from a position of extreme ignorance on how a technology works. It's not the government or corporations destroying the world, it's a toxic ignorance of the world around us, an ignorance which we use to then make decisions and pass judgement.
Congratulations. Now go put on your tinfoil hat.
Re: (Score:2)
Its very difficult for consumers to act collectively. For example, I don't want to be tracked, but to achieve that goal I'd have to give up my cell phone, my credit cards, driving a late model car, etc etc. I *could* do it, but the cost to me as an individual is huge. I could not continue in my career, or live anything like the life I want. Like most people, the disadvantage of tracking to *me* are pretty minor, even though I think the overall societal harm is large. Its a prisoners dilemma.
I think th
Re: (Score:2)
You can also fix the devices you use.
From the users' view in the repairman's sense, from their makers' view in the veterinary sense.
Re:Surveillance state (Score:5, Interesting)
Imagine in the old days you walked into a shop and bought a (legal) porn mag. There is some possibility that someone you knew might see you but there is no reall recording. If later you run for political office, having someone say "I saw Fred buy a porn mag back in 1993" doesn't really carry much weight .
Now imagine that instead there is a record of every porn video you have watched. Now when you run for office, there is this verifiable data trail that links you, the candidate, with you the person who might have some harmless kinks. Worse, you are exposed to ex post facto changes in social rules. Maybe 20 years from now all porn, or some particular type of porn is viewed as horribly offensive, even though today no one gives it much thought.
Not just porn. There are records of looking up divorce laws, expenditures on exotic luxury goods, political posts that might have become offensive 20 years later. etc etc.
The world changes and this level of surveillance allows people to be judged for long ago actions by new standards. Sometimes that is OK, but sometimes people forget that standards for acceptable behavior really do change with time .
At least with a password . . . (Score:2)
one can write it down and keep it safe in case you forget it. What happens when, not if, but when this newest piece of shit software doesn't recognize you? Will you have to keep staring into the camera or sliding your finger across the bar in the hope the system will recognize you?
And when, again, when the system doesn't recognize you, what next? Do you call Microsoft and tell them their shit software has locked you out of your own system and you can't get to your files or do your job? Will Microsoft tel
Re: (Score:2)
MS arn't interested in you as a user, they're only interested in firing off buzzword bullshit in the direction of their investors and the small coterie of circle jerk techno evangelists who don't really understand security but have read too many of the aforementioned sci fi novels and think the real world is just another novel they're living in.
Re: (Score:2)
Re: (Score:2)
In other words, people who don't work keep those who would from doing any.
Re: (Score:2)
Windows Hell-no. (Score:4, Insightful)
Re: (Score:3)
Good luck if you want to use your fingerprints (Score:5, Interesting)
For several years, I have been working in banks, with large teams of people using specialist trading keyboards built by Bloomberg (picture a normal QWERTY keyboard with a bunch of extra buttons, pre-programmed macros, colour-coding all over the place, and built to withstand daily tantrums and being hit by stressed users), which have very good (dare I say, state-of-the-art) fingerprint scanners on them.
A certain percentage of users cannot use them - the ridges on their fingerprints are too small.
In winter, a higher percentage of users cannot use them because the cold lowers the height of those fingerprint ridges.
This colleague used a hand cream a few mintues ago... their keyboard would not validate their fingerprint because of the oil in the hand cream.
That colleague cut the finger they use for authentication when doing DIY at the weekend, and now they cannot login, because their back-up finger (not the one they stick up their backside when bored... but the one the system says "register this as an alternative for when your primary finger is unavailable") doesn't work for some reason.
And these Bloomberg keyboards are damned expensive, so they use premium quality components. Consider how reliable the sensors on cost-focussed consumer keyboards are going to be.
Re: (Score:2)
Re: (Score:2)
I have to re-enter my fingerprints about 2x a month on average with my Galaxy S9+, and it refuses to work period if my hands have been wet and pruny at all.
That'd be fine, except my hands are frequently covered in grease, or scraped up a little. Even giving my hands a good thorough cleaning won't work after that sort of thing.
People do actually still use their hands, even in technical positions. If you work in an industrial or manufacturing environment, that's pretty common.
Re: (Score:2)
It's not because they're expensive that they use quality components, especially in the niche areas. They are expensive because banks buy them regardless of the tech in them.
Translation: (Score:3)
Re: (Score:3)
Re: (Score:2)
Re: (Score:3)
You might think I'm joking or insane. I'm not. Consider a local account with no password, but where remote access is totally disabled.
Now consider a Microsoft account which has ostensibly strong security, but which allows Microsoft's mothership to control system settings, leaks data to Microsoft's cloud, and allows Microsoft to reset authentication using an email address or phone # (in case of a failed sensor or lost PIN).
As long as the former device is in the owner's physical possession, it's actually mo
finer print and iris scanner is a username (Score:2)
Biometrics are not for authentication (Score:5, Insightful)
When logging in to a system, two steps are usually taken: the identification step, where you state who you are, and the authentication step, where you prove that you are actually the person you claim to be. The identification is often done by entering a username and the authentication by entering the well-known password. Both the username and password have a number of attributes. Let's take a look at them.
Identification: the username
Authentication: the password
Now, let's take a look at the characteristics of a person's biometric characteristics, such as the fingerprint and the iris scan.
Biometric characteristics
If you compare the properties of biometrics with those of the username and password, you will see that biometrics looks more like a username than a password. In addition, demonstrating who you are with what you are is a weak method, because it is visible to everyone and can even be imitated.
So, biometric are a substitute for the username, not for the password.
Re: (Score:2)
Re: (Score:3)
Its not a good solution for the product (windows users), it is a very good solution for the customers (organizations that purchase the personally identified data).
Its part of the goal of completely eliminating anonymity on the web.
Re: (Score:2)
I don't think it's right to see biometric authentication as non-modifiable public passwords.
I believe you can see biometric authentication as follow. There is a guard at the entrance of your company. To enter, you have three way at our disposal:
You can present them an id card. This is "something you have". Smart cards are the usual example in IT. The problem is someone can stole it and enter.
The problem with this concept in context of TFA there is no actual physical guard post. It's just shit happening on individual desktop systems and mobile handsets. When biometrics are involved failures last a lifetime.
Modern biometric system use anti-spoofing (also called Presentation Attack Detection) method that make a feasible replay very difficult.
I don't believe in voodoo magic. When a guarded secret is compromised it loses all value. To pretend otherwise is a fools errand.
Worse than passwords (Score:2)
Identification != authentication. Already we have enough trouble people are using identifiers like social security numbers, mother's maiden names, high school mascots and honeymoon locations as authentications. Now random images taken in security camera is enough to fake an authentication?
Aren't all these easily faked already? (Score:2)
'Iris scan'? I've never seen a computer that has an 'iris scanner' and I somehow don't think I ever will -- and I'm sure this can be faked, too?
I don't get what they're thinking here. Nobody is going to stop using passwords in favor of these things.
Ben, are you OK? (Score:2)
Microsoft moves windows closer to irrelevance (Score:2)
Passwords are not going anywhere.
Biometrics are unreliable, have terrible entropy and cannot be changed as need arises. The attempt to push biometrics is a play to weaken security not strengthen it.
If Microsoft really gave a shit they would be deploying and pushing the use of secure zero knowledge authentication systems.
If they really gave a shit they wouldn't be storing unsalted unamplified hashes in local SAM databases on hundreds of millions of computers.
Microsoft doesn't care about security. They care
Re: (Score:2)
The attempt to push biometrics is a play to weaken security not strengthen it.
MicroSoft has always been strong in the Dark Side of the Force, don't underestimate their planning capability.
They don't want to weaken security. They know this wouldn't work well for many common, important situations.
What if they're not idiots? What if they're run by a Sith Lord?
In that case, they're almost certainly trying to further increase expectations of convenience. If they can get users to expect authentication to be easier than it currently can be, then in the future those users will be more recept
If ever there was a reason (Score:2)
If ever there was a reason to dump Windows and move to any other OS, this would be it.
If they made it 100% optional, then maybe, but it doesn't look like that's the case.
Windows Hello is "a biometrics-based technology (Score:2)
Re: (Score:2)
With the mistaken use of biometrics as a password in the case of genitalia, revocation of password will mean mandatory gender reassignment or neutering.
Fingerprint, iris scan or facial recognition (Score:2)
and these biometrics-based files would be stored at that NSA server farm in Utah
Re: (Score:2)
Microsoft also terminated password rotation/expiration with this month's Windows 10 update.
https://it.slashdot.org/story/19/04/25/2042237/microsoft-drops-60-day-password-expiration-policy [slashdot.org]
Re: (Score:2)
how would facial recognition even work, with cameras taped over and such?
They will recognise my sticky tape.
Re: (Score:2)
Putting some cover over the entire display will do the trick. One way mirrors are a reality, as you know.