ISSUE 20.46 • 2023-11-13 PUBLIC DEFENDER By Brian Livingston A new Microsoft sign-in method — designed to replace today’s relatively insecure username
[See the full post at: The Windows 10/11 Hello PIN works, but change is coming]
|
Patch reliability is unclear. Unless you have an immediate, pressing need to install a specific patch, don't do it. |
-
The Windows 10/11 Hello PIN works, but change is coming
- This topic has 59 replies, 19 voices, and was last updated 1 week, 3 days ago.
AuthorViewing 20 reply threadsAuthor-
-
I disagree with Oleg Afonin’s article, which the previous comment links to. His method requires that someone possesses your PC and boots it using software that Afonin sells. The software uses brute force to break full-disk encryption, never mind an encrypted Hello PIN.
As you know, if a malicious person has his hands on your PC, the game is over and you have lost. Lock it up.
Also, Afonin says his method doesn’t work if a numeric Hello PIN is longer than 6 digits, or it includes even a single alphabetical character or symbol. In those cases, the attack must be performed offline on a dedicated machine, which can require hours.
By the way, I don’t recommend Windows Hello, which is Microsoft-specific. I recommend W3C-compliant passkeys, which Microsoft began to support in Win11 with a September 2023 update. That’s the subject of my second column in the series, which will be published on Nov. 20, 2023.
So what happens if I try to log onto my PC when I have an internet outage? Or if there is a power cut and I try to use my laptop, which does not have mobile connectivity? Am I locked out for the duration?
Chris
Win 10 Pro x64 Group A1 user thanked author for this post.
-
No. A PIN is only stored locally: Internet not required for Windows login.
1 user thanked author for this post.
When I got my new phone, I was excited to see that it had fingerprint recognition as a means of access
After a few weeks I stopped trying to log in using fingerprint recognition, because the stoopid thing stopped recognising my fingerprints
When I got my new phone, I was also excited to see that it had face recognition as a means of access
After a few weeks I stopped trying to log in using face recognition, because the stoopid thing stopped recognising my face
I now log in with the time-honoured fashion of using a password. It has never stopped recognising THAT
So, yeah, there’s always something new and sexy around the corner, trying to persuade us that the old ways are insecure and out of date, and we must UPGRADE NOW! OR ELSE! (Which is pretty much always the bottom line)
4 users thanked author for this post.
-
-
You hadn’t posted for more than six months.
1 user thanked author for this post.
-
I’m assuming you are on Win 10 but this may be the same in Win 11:
If you are using a Local account rather than a Microsoft account and you want to remove the password requirement from your desktop PC, go to Settings>Accounts>Sign-in options. Then Click on the “Password” selection with the “Key” icon. Then click on the “Change” button. You will get a window where you must put in your current password and click “Next”. You will then get a window for entering a new password and a hint. Leave all of this blank and click “Next”. Next time you restart your PC it should sign you in without entering any password. (If you are using a Microsoft account, then I’m not the one to help as I don’t have any of my machines set up that way…)
Win10 Pro x64 22H2, Win10 Home 22H2, Linux Mint + a cat with 'tortitude'.
1 user thanked author for this post.
-
See Part 2 of my series on Nov. 20, 2023, which will answer this and other questions. In short, with W3C/FIDO-compliant passkeys (which Microsoft in September added to Windows 11) you only need to set up one authorization method. It can be a PIN up to 127 characters in length or a biometric method. You do not need to set up a different method for each different website or resource you sign in to.
1 user thanked author for this post.
Add me to the list of those wondering if this would even work if I don’t use a Microsoft account. Sorry, but as far as trust with my personal information goes I have Microsoft on the same shelf as Google and Facebook!
I notice someone mentioned having trouble with biometric identification, which leads nicely into my next point. I’d like to see an article sometime — if it’s been written somewhere and somebody can point me to it that’s fine — about how reliable biometrics are. When I was being fingerprinted for my security clearance 45 years ago, the technician observed that I must work with paper a lot since I had so many minuscule cuts. That can only have increased over time; will that affect fingerprint recognition? I have both a cataract and a tumor in one eye. Will they affect a retinal scan? Even a DNA test wouldn’t be 100% foolproof (one’s DNA can change over time — granted, only a tiny-beyond-tiny bit, but what if it’s the bit that happens to get tested?).
2 users thanked author for this post.
It may be more secure, but… yeah, not digging it.
To beat a dead horse, authentication methods are something you either are, know, or have. Passkeys cleverly combine all three in a way – your phone, your fingerprint or face, your PIN, all on your side of the Internet.
Problem is almost that it’s too secure. Passwords are device-agnostic and as a concept cannot ever be tied to one proprietary set of hardware. Since the authentication information (theoretically) never leaves the device, passkeys enforce trusted devices – you HAVE to have a device on you at all times to access anything. So if you’re homeless, or your house burned down, or someone stole everything including your shirt and shoes, you are absolutely screwed now, not just almost-definitely screwed. And that’s catastrophes. Phones break all the time. If your one trusted device starts acting up and needs to be repaired for a few days, you are still SOL. It’s pretty classist to assume that someone can afford multiple devices when most Americans can’t cover a $500 emergency, of which this is one!
Ah, but in case of emergency, use a backup code, you say? How ingenious. Something that is basically a glorified password, only even worse because it’s usually just numeric, and you never use it so you are less likely to remember it than a password, and you probably kept it on your device, or on a slip of paper in your house which you are now locked out of because the phone that unlocks the house was stolen. Or it burned down. Or your safe was robbed. Why didn’t I think of that.
So yes, passkeys may be more secure. I also see them as a way to tie people to proprietary software and hardware systems, destroy truly “anonymous” accounts, and push all security responsibility onto the end-user in an era where the phrase “customer service” is its own punchline.
I have many of the same concerns as Average-Jane and others. I certainly see the value in passwordless authentication especially for corporate enterprise situations where security is tantamount. For the use case as an individual, there seem to be other difficulties trying to go passwordless:
Hardware requirements like TPM or a Yubikey. I want portability to sign in from other devices than just my own. I looked at Yubikey and similar USB devices. They were expensive. They can break or get lost, so at least one duplicate is almost a necessity – increasing the cost substantially. Some while ago I checked a listing of which sites support sign-in via a FIDO key and found only a very limited number of sites that I actually use, so the uptake of this technology isn’t as widespread as I’d like. I’d still have to use username/password sign-ins at most sites. I looked at the link of sites that support the “passkey” technology and only found 8 sites that I use – again leaving the great majority of my sign-ins not supported. Is there a site somewhere listing all the sites that will accept Windows Hello authenication?
I certainly have much more to learn about efforts at passwordless authentication technologies. I hope a universal standard emerges that has near universal uptake. I do understand the insecurities of using passwords but I’m not especially keen on relying on a centralized third-party ‘overlord’ deciding if I’m a trusted user before allowing me to sign in to my accounts. At least until I fully understand how it all works and how much of my agency I’m turning over to them. One ring to rule them all? 😉
At present, I’m comfortable with my self-hosted, encrypted password manager, using extremely long random passwords unique to each site, disallowing any saving of sign-ins in browsers, routinely checking all passwords against the ‘Have I Been Pwned’ database, enabling 2-factor notifications for sign-ins wherever possible and practicing good internet hygiene.
Win10 Pro x64 22H2, Win10 Home 22H2, Linux Mint + a cat with 'tortitude'.
3 users thanked author for this post.
I disagree. This is a half-baked, substandard implementation designed to placate those users that are less technically inclined. There is nothing inherently wrong with a strong password. Saying there is because you have a newer method does not make it so.
In most countries one cannot be compelled to provide their password without a court order. In some cases where you’re asked or compelled to provide and you refuse they simply cannot gain access if the password is strong enough. If you have it set to use biometrics they simply have to pass the device in front of your face or have you touch it and there you go. Criminal or Court or Law Enforcement has 100% FULL access. Now tell me that’s more secure and I have a bridge to sell you I got cheap from San Francisco.
5 users thanked author for this post.
-
There is nothing inherently wrong with a strong password. Saying there is because you have a newer method does not make it so.
Passwords are transmitted via internet and stored on servers (unlike passkeys).
1 user thanked author for this post.
-
-
Like the others in this thread who’ve asked this question (which has not yet been answered) does Windows Hello work when you only have a local account?
Yes.
Always create a fresh drive image before making system changes/Windows updates; you may need to start over!We were all once "Average Users". We all have our own reasons for doing the things that we do with our systems, we don't need anyone's approval, and we don't all have to do the same things.1 user thanked author for this post.
-
nor do I consider it less secure that passkeys
Passkeys cannot be inadvertently entered at malicious phishing sites and aren’t stored on servers where passwords are vulnerable to data breach:
1 user thanked author for this post.
-
-
-
-
-
With passkeys, the authentication token is different every time you sign in to a different server. The device you’re using — and the server you’re visiting — exchange a pair of public/private keys. The server then sends your device a challenge, and your device replies with the correct cryptographic response. The server recognizes that only your device (which has the proper key) could have responded correctly to the challenge. You are therefore signed in without revealing a password or a passkey.
If you lose a device that stores a passkey, you can cancel the device’s service and establish a new passkey. That’s much more secure than a server that can be hacked to reveal the usernames and passwords it retains. More than 24 billion username/password combinations are currently for sale on the Dark Web (according to Digital Shadows). If a hacker buys a password of yours that signs into an ecommerce site, you wouldn’t even know about it until you received your credit-card bill weeks later.
1 user thanked author for this post.
-
-
It still does not bypass the fact that in many countries one cannot be compelled to provide your password without a court of law order. However by using bio metrics such as your finger print or facial recognition then neither law enforcement or criminals need your permission. They simply pass the device in front of your face or touch your finger to the device and then they have access. I’m sorry but I find that extremely insecure. Journalists traveling with an iPhone and having facial recognition enabled have had their phones compromised. If they had that feature disabled their phone would have been safe.
Losing the device if anything like a Yubi key is not easy or straight forward especially for many home users that already find computing difficult.
1 user thanked author for this post.
-
-
-
-
Passkeys must be for the 99.999% of the population who will/do/are.
Apparently there must have been a massive sea change since April of this year.
Fragmentation, Lack of Adoption Impede Uptake of PasswordLess Logins
“Most of your users today already have the tech on their systems to use passkeys, now it’s just a question of when do we start to roll out,” he said.
Essentially, Apple, Google, and Microsoft have laid out the infrastructure to support passkeys across Chrome, Android, iOS, macOS, and Windows. But there’s a lack of adoption in the industry, in addition to fragmentation over how each operating system implements them.
“Ideally, all your devices—whether they run Android, iOS or Windows—would be able to use and share the same collection of passkeys to authenticate the logins for all your websites and apps. But in reality, you can’t share the passkeys between software ecosystems,” Brand said. That means Apple and Google devices need to store and maintain their own separate set of passkeys.
Still, explaining all the nuances of passkeys to the average tech user is a challenge. For example, the fragmentation issue brings up the need for a centralized way to make it easy for a user to see all the passkeys for their various accounts.
“I haven’t really seen good examples of passkey management out there yet in the field,” he added. “A lot of this stuff is still early days. This is kind of part of the ugly. We haven’t quite got this figured out as an industry.”
“It’s expected that passkeys will eventually replace passwords entirely, though it’s going to take some time.” — (Updated Nov 15, 2023, 1:01 PM EST)
And there’s this:
Perhaps “99.999%” is a bit optimistic? I remain (along with some other AskWoody members it appears) unimpressed with and unconcerned for the necessity of passkeys.
Always create a fresh drive image before making system changes/Windows updates; you may need to start over!We were all once "Average Users". We all have our own reasons for doing the things that we do with our systems, we don't need anyone's approval, and we don't all have to do the same things. -
-
-
-
Only 18%, or approximately 203,400,000, of all websites are actively visited and maintained.
Well now, that is a Big Change. Instead of 0.00000000007.52% of websites ready for passkeys, it’s closer to 0.00000004.18% of websites ready for passkeys. We’ve moved the decimal three places closer!
Also, I must correct myself. I do have a OneDrive account, so I use Microsoft out of that Sea Change list of 85 sites. But that login is handled in the background when I sign into my daily driver, and it does not use a passkey. I also have an Outlook email account, but again, that login is handled by Outlook at launch, in the background, also does not use a passkey, and I use Amazon from that list.
Other than those two exceptions, none of the sites I visit regularly, nor my financial institutions use passkeys. HTTPS meets my personal level of security requirement for these transactions. At this point in time, the passkey hype is just that—hype. I’m unimpressed.
Always create a fresh drive image before making system changes/Windows updates; you may need to start over!We were all once "Average Users". We all have our own reasons for doing the things that we do with our systems, we don't need anyone's approval, and we don't all have to do the same things.1 user thanked author for this post.
-
-
-
The number of sites doesn’t count.
The number of sites counts as far as determining “death to passwords!” That number is going to have to climb exponentially before Brian or anyone else can say passwords are dead. And as I mentioned, none of the financial institutions with whom I have dealings are in that list of 85, yet I am more than satisfied with the level of security they provide for my transactions.
A Bad Actor will need direct access to my daily driver and know the password/PIN for both signing into my PC and opening my protected list of sites/passwords; a very remote likelihood. Remembering complicated passwords is not an issue for me. Passing userid and password through the end-to-end encryption of HTTPS is not an issue for me.
Until the sites I need to use require passkeys and no longer honor user id and password, all the rest of this is just so much FUD. I’m unimpressed. Passwords are not dead. I use different passwords for every site, and manage them with ease. I’ll not be setting up passkeys any time soon.
Always create a fresh drive image before making system changes/Windows updates; you may need to start over!We were all once "Average Users". We all have our own reasons for doing the things that we do with our systems, we don't need anyone's approval, and we don't all have to do the same things.1 user thanked author for this post.
-
Amazon officially adopted the method on October 23
Just bought some stuff off Amazon late yesterday, Nov 21, and they accepted my existing login combo for the purchase with no prompt indicating I had to change my login combo to a passkey!
1 user thanked author for this post.
-
Just bought some stuff off Amazon late yesterday, Nov 21, and they accepted my existing login combo for the purchase with no prompt indicating I had to change my login combo to a passkey!
And I foresee that to be the case for years, if not decades to come. In my experience Amazon is highly unlikely to refuse to take anyone’s money for any reason.
Always create a fresh drive image before making system changes/Windows updates; you may need to start over!We were all once "Average Users". We all have our own reasons for doing the things that we do with our systems, we don't need anyone's approval, and we don't all have to do the same things.1 user thanked author for this post.
I still see Passkeys as one point of failure. It still uses a 3rd party to verify but I see no info on how that happens. Still needs com between 3rd party and needed site.
🍻
Just because you don't know where you are going doesn't mean any road will get you there.1 user thanked author for this post.
Viewing 20 reply threads
Plus Membership
Donations from Plus members keep this site going. You can identify the people who support AskWoody by the Plus badge on their avatars.
AskWoody Plus members not only get access to all of the contents of this site -- including Susan Bradley's frequently updated Patch Watch listing -- they also receive weekly AskWoody Plus Newsletters (formerly Windows Secrets Newsletter) and AskWoody Plus Alerts, emails when there are important breaking developments.
Get Plus!
Recent Topics
-
End of support W10
by 6 minutes ago
-
MS-DEFCON 2: Copilot for Christmas
by 47 minutes ago
-
Sudden appearance of Edge Search Bar
by 1 hour, 1 minute ago
-
LogoFAIL firmware exploit bypasses hardware and software security
by 46 minutes ago
-
Microsoft outlook ignores the registry keys
by 22 hours, 32 minutes ago
-
Windows 11 Insider Preview Build 22635.2841 released to BETA
by 17 hours, 56 minutes ago
-
Thunderbird doesn’t open folders at most recent email in Inbox
by 15 hours, 13 minutes ago
-
Three queries about the MS Outlook app on iPadOS
by 21 hours, 29 minutes ago
-
Win 10 22H2 November patches: Why do I have these 4 Windows App Runtime apps?
by 4 hours, 49 minutes ago
-
KB5032278
by 16 hours, 49 minutes ago
-
A web browser security testing & privacy testing tool.
by 1 day, 7 hours ago
-
IOS 17.1.2 looses text alert tone
by 20 hours, 59 minutes ago
-
What to know about CentOS Linux EOL
by 1 day, 14 hours ago
-
ESU announcement coming?
by 12 hours, 58 minutes ago
-
December 2023 Office non-Security Updates
by 1 day, 8 hours ago
-
Widespread Printer Bug caused by Windows Store!
by 14 hours, 41 minutes ago
-
Xbox question
by 1 day, 15 hours ago
-
Unfound Updates
by 1 day, 12 hours ago
-
Thieves rob DC Uber Eats driver, reject Android phone for not being iPhone
by 1 day, 14 hours ago
-
McAfee popup add (from micro. Store)
by 1 day, 15 hours ago
-
Random Screen Shut Downs (Windows 11 Pro)
by 2 hours, 53 minutes ago
-
CPU performance degradation after 23H2 update
by 2 days, 3 hours ago
-
PDFgear
by 12 hours, 38 minutes ago
-
I’m getting a new computer. I need instructions on setting it up CORRECTLY
by 2 hours, 44 minutes ago
-
Microsoft will not activate a valid reinstall of Office 16
by 1 day, 11 hours ago
-
Dell laptop Win 11 BLACK screen!
by 11 hours, 38 minutes ago
-
Firefox change from French to English.
by 1 day, 14 hours ago
-
W10 22H2 Nov 2023 PT Update: No monsters here
by 2 days, 3 hours ago
-
Windows : Is This the End of ‘Intel Inside’ ?
by 2 days, 7 hours ago
-
windows 10 upgrade to 11
by 2 days, 11 hours ago
