How To Enable Windows Hello

How Secure Is Windows Hello?

Microsoft today (October. 6) unveiled several new devices, including 2 loftier-end Lumia smartphones, a new Surface Pro tablet and the first Microsoft-branded laptop, the Surface Volume. All four include Windows Hello, the biometric-authentication technology Microsoft introduced with Windows 10, but implement information technology in different ways, with varying levels of security.

(Image credit: Microsoft's Surface Book laptop. Credit: Microsoft)

Facial recognition

The new tablet, called the Surface Pro iv (starting at $899), and the Surface Book laptop (starting at $1,499) each come with a Windows Hello-approved facial-recognition camera. The only previously-approved photographic camera was Intel's RealSense F200, which appears on a handful of PCs and uses two divide lenses and an infrared (IR) blaster to get a 3D view of your visage. Since Microsoft didn't mention Intel's camera past name, we'll assume that its products are using a unlike component with similar capabilities.

MORE: Microsoft's Big Twenty-four hour period: Surface Volume, Lumia and HoloLens

Windows Hi facial recognition is pretty solid from a security standpoint. Many facial-recognition tools, such every bit Android's Face Unlock, can be fooled by a life-sized loftier-resolution photograph, simply Windows Hello uses the dual cameras to create a virtual 3D model of the registered user'south face. (Users may have to move around while registering themselves so the photographic camera tin can capture more angles.) Thanks to the IR blaster, the Windows Hullo facial recognition can (according to Microsoft) fifty-fifty piece of work in the dark.

Fingerprint reader

The Surface Pro 4 tin can also be used with an optional keyboard ($130 extra), which has its own selection to come with a fingerprint reader (presumably more than $130). Windows Hello handles fingerprint readers well, and is backwards uniform with the finger-swipe readers built into many older business laptops.

The Surface Pro 4, with the non-fingerprint-reading keyboard. Credit: Microsoft — (Prototype credit: The Surface Pro 4, with the not-fingerprint-reading keyboard. Credit: Microsoft)

But nigh fingerprint readers can be fooled with a condom fingerprint. Even Apple's much-ballyhooed Touch ID fingerprint reader can exist spoofed past overlaying a fake fingerprint over a living finger, which provides the proof-of-life the Apple applied science requires.

If you're concerned about biometric security for your Surface Pro 4, stick with the congenital-in facial recognition and skip the fingerprint reader. The Surface Volume, which according to Microsoft executive Panos Panay is "the most powerful laptop e'er fabricated," doesn't include a fingerprint reader.

Iris or retinal scans — perchance

Today'south Microsoft presentation, and a related video, said the Lumia 950 ($549 unlocked) and Lumia 950 Twoscore ($649 unlocked) smartphones include "Windows Hello Beta." All the same because the Microsoft spec sheets we got for the handsets don't mention Windows Hello, and the Microsoft Store folio for the 950 Twoscore says but that the device is "Windows Hello ready," we don't know exactly how the biometric-unlocking characteristic volition work on either phone.

(Image credit: The Lumia 950, left, and the Lumia 950 XL. Credit: Microsoft)

Nosotros practice accept a good of how information technology won't piece of work. The approved Windows Hullo facial-recognition photographic camera is four inches broad, and then information technology wouldn't fit on the top edge of a smartphone. And the phones don't appear to take fingerprint readers.

That leaves a few camera-based options: regular ii-dimensional facial recognition, iris scans or a retinal scans. Regular facial recognition would be easiest to implement, and, as nosotros've already mentioned, easiest to fool.

Iris recognition, which already exists on a few Android phones, uses a quick burst of infrared light to record the patterns of spots and bands surrounding the student in a person'due south eye. Iris patterns are every bit unique as fingerprints, and are easy to photo and match with digitized images. But iris scanners can be fooled past high-resolution photographs.

More than: High-Resolution Photos Fool Fingerprint, Iris Readers

Retinal scans, besides bachelor on a few Android phones, too utilize infrared light, but axle it deep into the pupil to illuminate the circuitous patterns of blood vessels on the back wall of the eye. Equally with fingerprints or iris patterns, each person has unique retinal patterns.

Retinal scanning is a little more intrusive than iris scanning, simply is harder to fool. You'd take to create a life-sized, 3-dimensional false eyeball with perfectly duplicated retinal patterns to shell it.

Microsoft-provided photos of the Lumia 950 and 950 40 show what may be IR blasters side by side to the regular lens on the faces of the phones. If then, the phones may have the hardware to perform either iris scans or retinal scans. We're asking Microsoft for further details and will update this story when we larn more than.

How to Set Up Touch ID
Lookout This: EyeLock's Iris Scanning Comes to Laptops
How You Blazon May Be Your Greatest Security Weakness

Paul Wagenseil is a senior editor at Tom'southward Guide focused on security and privacy. He has also been a dishwasher, fry cook, long-haul driver, code monkey and video editor. He's been rooting effectually in the information-security space for more than than 15 years at FoxNews.com, SecurityNewsDaily, TechNewsDaily and Tom'due south Guide, has presented talks at the ShmooCon, DerbyCon and BSides Las Vegas hacker conferences, shown upward in random Television news spots and even moderated a panel discussion at the CEDIA home-technology conference. Y'all can follow his rants on Twitter at @snd_wagenseil.