It looks like the days of the password are numbered. Microsoft has announced Windows Hello, a new biometric authentication system launching with Windows 10 in the (Northern hemisphere) fall. It means you'll be able to unlock your computer with a fingerprint or a face, just as you can on today's flagship smartphones.
With the software support Microsoft is placing in the next version of Windows, manufacturers can start adding the necessary scanners and lenses on the hardware side – and as Windows 10 is aiming to bring the same OS experience to smartphones, tablets, laptops, desktops and consoles, it's a significant step forward for biometric security.
"We want your devices to recognize you, to understand what you're saying ... we want the experience to go wherever you do and we want you to feel a great sense of trust as you go," writes Microsoft's Joe Belfiore in a blog post announcing the news.
The Redmond company is promising the system will be tightly secured too. Special infrared technology is going to be required in compatible cameras, for example, to distinguish between the real you and a photo of you. There are plans to roll Hello out everywhere Windows goes – government, defense, health – so security is going to be a primary concern.
Goodbye to the password?
It's another nail in the coffin for the long-serving password. While these strings of letters and numbers have had an important role to play, they're no longer able to cope with the rigors of today's technology. They're easy to crack for hackers and difficult to remember for users, with dozens of apps and services competing for attention and login credentials.
That's why most apps, sites, services and devices are now trying to move on to something else, whether that's the Touch ID fingerprint detection built into the newest iPhones or the Nymi Band that can use your heartbeat as a way of confirming your identity. Aside from Apple's efforts, projects like these have struggled to gain mainstream traction, but that should change with Microsoft's support.
Beneath Windows Hello is another new product, Microsoft Passport. Once you've confirmed your identity to your device – with Hello – this verification can be passed to apps and websites using Passport. If the app or site supports Passport, then there's no need to enter in another password or another set of login credentials.
What's more, your iris or your face won't be stored on your laptop (or other device), just an encrypted token that proves you are who you say you are. All of this new technology requires support from hardware makers and app developers, which may be why Microsoft is getting it announced well before Windows 10 finally goes on sale in a few months' time.
Microsoft's demo video showing the capabilities of Hello and Passport is linked below.
Source: Microsoft
For example I'd never discuss anything with an attorney who had a camera or microphone attached to his/her computer, or camera/smart phone if either were in the same room since there would be no guarantee that the content would remain confidential.
Biometrics do not always work (they're based on approximations), so they ALWAYS need a backup password for when that happens. Face-rec in particular is terrible in different lighting conditions.
In other words - Biometrics ADDS a SECOND new way for people to break into your gear: the old way (passwords) ALWAYS still exists, and the new way (face-rec, fingerprints, etc) is a SECOND new way they can break in.
Remember Apple? It took hackers LESS THAN 24HRS to break their fingerprint system: you needed only a gummy-bear and a photocopier. They can totally now bypass the useful & strong password, by just taking your fingerprint - and guess where they can find plenty of those? Ding: *ON* your stolen phone of course.
Despite that - yes - biometrics *is* more secure, but the reason is smoke and mirrors that's been pumped through an advertising PR machine: the only reason they tell you it's "more secure", is because most of us do not use any security at all: having something convenient and insecure that we DO use, is "more secure" than us not using anything at all.
As for the "your iris or your face won't be stored on your laptop" - this means it won't work without an internet connection, and your never-possible-to-change biometric data will be stored in a remote database where it can be stolen.
Here's 2 billion reasons why that's not a good idea: Sony, AOL, Target, Walmart, Ebay, Home Depot, Anthem, AOL (again), JP Morgan, Staples, Evernote, Adobe, UbiSoft, Yahoo, UPS, Sony (Again), Steam, Apple, AOL (again), ... that's how many hacked accounts have been stolen recently from places like those!
The ONLY place Biometric data should ever live (which itself is not very safe, but better than nothing), is trapped inside a security-hardened tamper-proof embedded chip in your own personal possession.
Every place I know with a working security conscience does not allow any kind of cameras... so this crazy idea can never work anyhow.