ISSUE 20.46 • 2023-11-13 PUBLIC DEFENDER By Brian Livingston A new Microsoft sign-in method — designed to replace today’s relatively insecure username
[See the full post at: The Windows 10/11 Hello PIN works, but change is coming]
|
Patch reliability is unclear, but widespread attacks make patching prudent. Go ahead and patch, but watch out for potential problems. |
-
The Windows 10/11 Hello PIN works, but change is coming
- This topic has 61 replies, 19 voices, and was last updated 4 days, 21 hours ago.
AuthorViewing 20 reply threadsAuthor-
-
I disagree with Oleg Afonin’s article, which the previous comment links to. His method requires that someone possesses your PC and boots it using software that Afonin sells. The software uses brute force to break full-disk encryption, never mind an encrypted Hello PIN.
As you know, if a malicious person has his hands on your PC, the game is over and you have lost. Lock it up.
Also, Afonin says his method doesn’t work if a numeric Hello PIN is longer than 6 digits, or it includes even a single alphabetical character or symbol. In those cases, the attack must be performed offline on a dedicated machine, which can require hours.
By the way, I don’t recommend Windows Hello, which is Microsoft-specific. I recommend W3C-compliant passkeys, which Microsoft began to support in Win11 with a September 2023 update. That’s the subject of my second column in the series, which will be published on Nov. 20, 2023.
So what happens if I try to log onto my PC when I have an internet outage? Or if there is a power cut and I try to use my laptop, which does not have mobile connectivity? Am I locked out for the duration?
Chris
Win 10 Pro x64 Group A1 user thanked author for this post.
-
No. A PIN is only stored locally: Internet not required for Windows login.
1 user thanked author for this post.
When I got my new phone, I was excited to see that it had fingerprint recognition as a means of access
After a few weeks I stopped trying to log in using fingerprint recognition, because the stoopid thing stopped recognising my fingerprints
When I got my new phone, I was also excited to see that it had face recognition as a means of access
After a few weeks I stopped trying to log in using face recognition, because the stoopid thing stopped recognising my face
I now log in with the time-honoured fashion of using a password. It has never stopped recognising THAT
So, yeah, there’s always something new and sexy around the corner, trying to persuade us that the old ways are insecure and out of date, and we must UPGRADE NOW! OR ELSE! (Which is pretty much always the bottom line)
4 users thanked author for this post.
-
-
You hadn’t posted for more than six months.
1 user thanked author for this post.
-
I’m assuming you are on Win 10 but this may be the same in Win 11:
If you are using a Local account rather than a Microsoft account and you want to remove the password requirement from your desktop PC, go to Settings>Accounts>Sign-in options. Then Click on the “Password” selection with the “Key” icon. Then click on the “Change” button. You will get a window where you must put in your current password and click “Next”. You will then get a window for entering a new password and a hint. Leave all of this blank and click “Next”. Next time you restart your PC it should sign you in without entering any password. (If you are using a Microsoft account, then I’m not the one to help as I don’t have any of my machines set up that way…)
Win10 Pro x64 22H2, Win10 Home 22H2, Linux Mint + a cat with 'tortitude'.
1 user thanked author for this post.
-
See Part 2 of my series on Nov. 20, 2023, which will answer this and other questions. In short, with W3C/FIDO-compliant passkeys (which Microsoft in September added to Windows 11) you only need to set up one authorization method. It can be a PIN up to 127 characters in length or a biometric method. You do not need to set up a different method for each different website or resource you sign in to.
1 user thanked author for this post.
Add me to the list of those wondering if this would even work if I don’t use a Microsoft account. Sorry, but as far as trust with my personal information goes I have Microsoft on the same shelf as Google and Facebook!
I notice someone mentioned having trouble with biometric identification, which leads nicely into my next point. I’d like to see an article sometime — if it’s been written somewhere and somebody can point me to it that’s fine — about how reliable biometrics are. When I was being fingerprinted for my security clearance 45 years ago, the technician observed that I must work with paper a lot since I had so many minuscule cuts. That can only have increased over time; will that affect fingerprint recognition? I have both a cataract and a tumor in one eye. Will they affect a retinal scan? Even a DNA test wouldn’t be 100% foolproof (one’s DNA can change over time — granted, only a tiny-beyond-tiny bit, but what if it’s the bit that happens to get tested?).
2 users thanked author for this post.
It may be more secure, but… yeah, not digging it.
To beat a dead horse, authentication methods are something you either are, know, or have. Passkeys cleverly combine all three in a way – your phone, your fingerprint or face, your PIN, all on your side of the Internet.
Problem is almost that it’s too secure. Passwords are device-agnostic and as a concept cannot ever be tied to one proprietary set of hardware. Since the authentication information (theoretically) never leaves the device, passkeys enforce trusted devices – you HAVE to have a device on you at all times to access anything. So if you’re homeless, or your house burned down, or someone stole everything including your shirt and shoes, you are absolutely screwed now, not just almost-definitely screwed. And that’s catastrophes. Phones break all the time. If your one trusted device starts acting up and needs to be repaired for a few days, you are still SOL. It’s pretty classist to assume that someone can afford multiple devices when most Americans can’t cover a $500 emergency, of which this is one!
Ah, but in case of emergency, use a backup code, you say? How ingenious. Something that is basically a glorified password, only even worse because it’s usually just numeric, and you never use it so you are less likely to remember it than a password, and you probably kept it on your device, or on a slip of paper in your house which you are now locked out of because the phone that unlocks the house was stolen. Or it burned down. Or your safe was robbed. Why didn’t I think of that.
So yes, passkeys may be more secure. I also see them as a way to tie people to proprietary software and hardware systems, destroy truly “anonymous” accounts, and push all security responsibility onto the end-user in an era where the phrase “customer service” is its own punchline.
I have many of the same concerns as Average-Jane and others. I certainly see the value in passwordless authentication especially for corporate enterprise situations where security is tantamount. For the use case as an individual, there seem to be other difficulties trying to go passwordless:
Hardware requirements like TPM or a Yubikey. I want portability to sign in from other devices than just my own. I looked at Yubikey and similar USB devices. They were expensive. They can break or get lost, so at least one duplicate is almost a necessity – increasing the cost substantially. Some while ago I checked a listing of which sites support sign-in via a FIDO key and found only a very limited number of sites that I actually use, so the uptake of this technology isn’t as widespread as I’d like. I’d still have to use username/password sign-ins at most sites. I looked at the link of sites that support the “passkey” technology and only found 8 sites that I use – again leaving the great majority of my sign-ins not supported. Is there a site somewhere listing all the sites that will accept Windows Hello authenication?
I certainly have much more to learn about efforts at passwordless authentication technologies. I hope a universal standard emerges that has near universal uptake. I do understand the insecurities of using passwords but I’m not especially keen on relying on a centralized third-party ‘overlord’ deciding if I’m a trusted user before allowing me to sign in to my accounts. At least until I fully understand how it all works and how much of my agency I’m turning over to them. One ring to rule them all? 😉
At present, I’m comfortable with my self-hosted, encrypted password manager, using extremely long random passwords unique to each site, disallowing any saving of sign-ins in browsers, routinely checking all passwords against the ‘Have I Been Pwned’ database, enabling 2-factor notifications for sign-ins wherever possible and practicing good internet hygiene.
Win10 Pro x64 22H2, Win10 Home 22H2, Linux Mint + a cat with 'tortitude'.
3 users thanked author for this post.
I disagree. This is a half-baked, substandard implementation designed to placate those users that are less technically inclined. There is nothing inherently wrong with a strong password. Saying there is because you have a newer method does not make it so.
In most countries one cannot be compelled to provide their password without a court order. In some cases where you’re asked or compelled to provide and you refuse they simply cannot gain access if the password is strong enough. If you have it set to use biometrics they simply have to pass the device in front of your face or have you touch it and there you go. Criminal or Court or Law Enforcement has 100% FULL access. Now tell me that’s more secure and I have a bridge to sell you I got cheap from San Francisco.
5 users thanked author for this post.
-
There is nothing inherently wrong with a strong password. Saying there is because you have a newer method does not make it so.
Passwords are transmitted via internet and stored on servers (unlike passkeys).
1 user thanked author for this post.
-
-
Like the others in this thread who’ve asked this question (which has not yet been answered) does Windows Hello work when you only have a local account?
Yes.
Always create a fresh drive image before making system changes/Windows updates; you may need to start over!We were all once "Average Users". We all have our own reasons for doing the things that we do with our systems, we don't need anyone's approval, and we don't all have to do the same things.1 user thanked author for this post.
-
nor do I consider it less secure that passkeys
Passkeys cannot be inadvertently entered at malicious phishing sites and aren’t stored on servers where passwords are vulnerable to data breach:
1 user thanked author for this post.
-
-
-
-
-
With passkeys, the authentication token is different every time you sign in to a different server. The device you’re using — and the server you’re visiting — exchange a pair of public/private keys. The server then sends your device a challenge, and your device replies with the correct cryptographic response. The server recognizes that only your device (which has the proper key) could have responded correctly to the challenge. You are therefore signed in without revealing a password or a passkey.
If you lose a device that stores a passkey, you can cancel the device’s service and establish a new passkey. That’s much more secure than a server that can be hacked to reveal the usernames and passwords it retains. More than 24 billion username/password combinations are currently for sale on the Dark Web (according to Digital Shadows). If a hacker buys a password of yours that signs into an ecommerce site, you wouldn’t even know about it until you received your credit-card bill weeks later.
1 user thanked author for this post.
-
-
It still does not bypass the fact that in many countries one cannot be compelled to provide your password without a court of law order. However by using bio metrics such as your finger print or facial recognition then neither law enforcement or criminals need your permission. They simply pass the device in front of your face or touch your finger to the device and then they have access. I’m sorry but I find that extremely insecure. Journalists traveling with an iPhone and having facial recognition enabled have had their phones compromised. If they had that feature disabled their phone would have been safe.
Losing the device if anything like a Yubi key is not easy or straight forward especially for many home users that already find computing difficult.
1 user thanked author for this post.
-
-
-
-
Passkeys must be for the 99.999% of the population who will/do/are.
Apparently there must have been a massive sea change since April of this year.
Fragmentation, Lack of Adoption Impede Uptake of PasswordLess Logins
“Most of your users today already have the tech on their systems to use passkeys, now it’s just a question of when do we start to roll out,” he said.
Essentially, Apple, Google, and Microsoft have laid out the infrastructure to support passkeys across Chrome, Android, iOS, macOS, and Windows. But there’s a lack of adoption in the industry, in addition to fragmentation over how each operating system implements them.
“Ideally, all your devices—whether they run Android, iOS or Windows—would be able to use and share the same collection of passkeys to authenticate the logins for all your websites and apps. But in reality, you can’t share the passkeys between software ecosystems,” Brand said. That means Apple and Google devices need to store and maintain their own separate set of passkeys.
Still, explaining all the nuances of passkeys to the average tech user is a challenge. For example, the fragmentation issue brings up the need for a centralized way to make it easy for a user to see all the passkeys for their various accounts.
“I haven’t really seen good examples of passkey management out there yet in the field,” he added. “A lot of this stuff is still early days. This is kind of part of the ugly. We haven’t quite got this figured out as an industry.”
“It’s expected that passkeys will eventually replace passwords entirely, though it’s going to take some time.” — (Updated Nov 15, 2023, 1:01 PM EST)
And there’s this:
Perhaps “99.999%” is a bit optimistic? I remain (along with some other AskWoody members it appears) unimpressed with and unconcerned for the necessity of passkeys.
Always create a fresh drive image before making system changes/Windows updates; you may need to start over!We were all once "Average Users". We all have our own reasons for doing the things that we do with our systems, we don't need anyone's approval, and we don't all have to do the same things. -
-
-
-
Only 18%, or approximately 203,400,000, of all websites are actively visited and maintained.
Well now, that is a Big Change. Instead of 0.00000000007.52% of websites ready for passkeys, it’s closer to 0.00000004.18% of websites ready for passkeys. We’ve moved the decimal three places closer!
Also, I must correct myself. I do have a OneDrive account, so I use Microsoft out of that Sea Change list of 85 sites. But that login is handled in the background when I sign into my daily driver, and it does not use a passkey. I also have an Outlook email account, but again, that login is handled by Outlook at launch, in the background, also does not use a passkey, and I use Amazon from that list.
Other than those two exceptions, none of the sites I visit regularly, nor my financial institutions use passkeys. HTTPS meets my personal level of security requirement for these transactions. At this point in time, the passkey hype is just that—hype. I’m unimpressed.
Always create a fresh drive image before making system changes/Windows updates; you may need to start over!We were all once "Average Users". We all have our own reasons for doing the things that we do with our systems, we don't need anyone's approval, and we don't all have to do the same things.1 user thanked author for this post.
-
-
-
The number of sites doesn’t count.
The number of sites counts as far as determining “death to passwords!” That number is going to have to climb exponentially before Brian or anyone else can say passwords are dead. And as I mentioned, none of the financial institutions with whom I have dealings are in that list of 85, yet I am more than satisfied with the level of security they provide for my transactions.
A Bad Actor will need direct access to my daily driver and know the password/PIN for both signing into my PC and opening my protected list of sites/passwords; a very remote likelihood. Remembering complicated passwords is not an issue for me. Passing userid and password through the end-to-end encryption of HTTPS is not an issue for me.
Until the sites I need to use require passkeys and no longer honor user id and password, all the rest of this is just so much FUD. I’m unimpressed. Passwords are not dead. I use different passwords for every site, and manage them with ease. I’ll not be setting up passkeys any time soon.
Always create a fresh drive image before making system changes/Windows updates; you may need to start over!We were all once "Average Users". We all have our own reasons for doing the things that we do with our systems, we don't need anyone's approval, and we don't all have to do the same things.1 user thanked author for this post.
-
Amazon officially adopted the method on October 23
Just bought some stuff off Amazon late yesterday, Nov 21, and they accepted my existing login combo for the purchase with no prompt indicating I had to change my login combo to a passkey!
1 user thanked author for this post.
-
Just bought some stuff off Amazon late yesterday, Nov 21, and they accepted my existing login combo for the purchase with no prompt indicating I had to change my login combo to a passkey!
And I foresee that to be the case for years, if not decades to come. In my experience Amazon is highly unlikely to refuse to take anyone’s money for any reason.
Always create a fresh drive image before making system changes/Windows updates; you may need to start over!We were all once "Average Users". We all have our own reasons for doing the things that we do with our systems, we don't need anyone's approval, and we don't all have to do the same things.1 user thanked author for this post.
I still see Passkeys as one point of failure. It still uses a 3rd party to verify but I see no info on how that happens. Still needs com between 3rd party and needed site.
🍻
Just because you don't know where you are going doesn't mean any road will get you there.1 user thanked author for this post.
Viewing 20 reply threads
Plus Membership
Donations from Plus members keep this site going. You can identify the people who support AskWoody by the Plus badge on their avatars.
AskWoody Plus members not only get access to all of the contents of this site -- including Susan Bradley's frequently updated Patch Watch listing -- they also receive weekly AskWoody Plus Newsletters (formerly Windows Secrets Newsletter) and AskWoody Plus Alerts, emails when there are important breaking developments.
Get Plus!
Recent Topics
-
Discover What Crime Attorney Is (Awaiting moderation)
by 17 minutes ago
-
Do I need these C++ updates ?
by 1 hour, 13 minutes ago
-
Woman in front of 2 mirrors. One shot 2 different reflections
by 12 hours, 43 minutes ago
-
Steam drops macOS Mojave support, effectively ending life for many 32-bit games
by 14 hours, 29 minutes ago
-
Requiring Bit-Locker key when it isnt activated after Win 11 update
by 9 hours, 58 minutes ago
-
KB5032189 Not installing on either of my PCs
by 4 hours, 51 minutes ago
-
Outlook.com – is there a way to delete all contacts in bulk?
by 21 hours, 23 minutes ago
-
Apple zero days fixed – November 30, 2023
by 7 hours, 37 minutes ago
-
found a skneaky way to get windows 11 free still.
by 1 day, 2 hours ago
-
Quickbooks – no new desktop subscriptions to be sold
by 1 day, 4 hours ago
-
Does updating to Win10 from Win7 Retain your applications successfully?
by 1 day, 2 hours ago
-
Using Dropbox source data for a Connection in Excel with different machines
by 1 day, 6 hours ago
-
Microsoft installing HP Smart secretly on non HP PCs
by 1 day, 5 hours ago
-
Fun Stuff – Mystery Zone
by 1 day, 19 hours ago
-
How to make sure GMAIL does not delete my account since they are not letting ..?
by 17 hours, 27 minutes ago
-
Windows Explorer – search for files that are not shortcuts?
by 1 day, 14 hours ago
-
Windows 11 Insider Preview build 23595 released to DEV
by 2 days, 1 hour ago
-
Windows 11 Insider Preview build 26002 released to Canary
by 1 day, 3 hours ago
-
Windows 11 Insider Preview Build 22635.2776 released to BETA
by 2 days, 2 hours ago
-
Getting ‘not genuine Windows’ after replacing HDD
by 1 day, 7 hours ago
-
Amazon Alexa Echo Hunches
by 2 days, 2 hours ago
-
Microsoft Defender Application Guard for Office is being deprecated
by 2 days, 3 hours ago
-
New BLUFFS attack lets attackers hijack Bluetooth connections
by 2 days, 4 hours ago
-
Don’t have your online identity in just one account
by 6 hours, 29 minutes ago
-
Sports Illustrated Published Articles by Fake, AI-Generated Writers
by 1 day, 23 hours ago
-
Windows 32bit to 64bit.
by 1 day, 6 hours ago
-
Lost icons in notification area, Windows 10
by 9 hours, 9 minutes ago
-
Test Apps in vm(?) so that I don’t break my current install
by 1 day, 1 hour ago
-
Removing Copilot
by 7 hours, 50 minutes ago
-
How do I disable CoPilot
by 2 days, 3 hours ago
