Windows 10: Manual submission of PIN with Windows Hello logon via Enter key or Submit button

I'm running Win10 Pro 1909 and have been trying out the PIN logon feature of Windows Hello. In doing so I've found a [minor?] security issue with the logon method and wish to change the behavior of the PIN logon process. Unfortunately I haven't found any information on how to change it nor if its even configurable in the help articles, via web searches, and elsewhere in this forum.


The issue is that upon entering a PIN at the logon screen, Windows automatically accepts the input and processes the typed data as soon as the correct number of characters has been entered, and then either logs in to Windows or returns an error as appropriate. The concern is that it does not require the use of the "Enter" key nor other submission method by the user to indicate to the system that they are finished with typing their PIN; the system does this automatically based solely on the number of entered characters. This is a security vulnerability because it allows anyone with physical access to the machine to determine the length of the user's PIN simply by pressing any key and counting the keypresses until the system attempts a login. This is a security vulnerability because PIN / password length information provides data which can be useful to an attacker for assessing attack methods as well as part of a social engineering attack. Requiring the user to press "Enter" or otherwise manually submit the entered PIN data would mitigate this exposure of PIN length.


So my question is this: Is there a Group Policy Object or other configuration point where I can tell Windows Hello to require manual submission of PIN entries versus the automatic submission based on the number of characters? If so, where is it please? Thanks.

:)

 

FingerPrint - Without Windows Hello PIN

Hi Xinete,

Thanks for posting your query on Microsoft Community.

As per your query, I like to inform you that; we cannot set the finger print Logon without setting the Windows hello pin. Windows hello pin will work as an alternative option to login to your computer through finger print Logon. Windows hello
pin will help you to login to your computer if you are unable to login to your computer through finger print authentication.

I suggest you to follow the below steps to enable finger print logon.

• 
  Press Windows key + r and type
  gpedit.msc and hit Enter.
  
• 
  Select Administrative Templates under
  Computer Configuration.
  
• 
  Select Windows Components.
  
• 
  Select Biometrics.
  

In Biometrics > consider that for a home system, you might enable the following:

1) Allow the use of biometrics

2) Allow users to log on using biometrics



For information, refer to the below link:

Biometric Facial Recognition – Windows Hello - Microsoft

Hope it helps, reply to us with the status of your issue. We will be happy to assist you.

 

Login with PIN and Hello

Hi Jean,

Windows 10 includes multiple options to sign-in to your account, including the ability to sign-in using a PIN and Windows Hello, which uses facial recognition. For us to provide a solution suited to your concern, we need additional information. Can
you answer the questions below?

• How are you setting the PIN and Hello?
• Which build version of Windows is your PC running on?
• Were there any error codes or messages?

In the meantime, we suggest that you follow the steps below on how to set up PIN.

• Open Settings.
• Select Accounts.
• Click Sign-in options.
• Click the Add button for the PIN and set your PIN.
• Do the same for the Windows Hello.

Looking forward to your response.

 

Unable to setup Windows Hello, error: incorrect pin

Hello,

Thank you for writing to Microsoft Community Forums.

May I know the complete error code or error message that you are receiving when you try to setup Windows Hello?

Do you have any other user account on the computer?

If yes, does Windows Hello work on that account?

If Windows Hello is not setup on other account, please setup it up and check if it works so that we can narrow down the issue for you.

I suggest to remove the pin and setup a new pin on the child account and check if it works with Windows Hello.

Please follow the steps below to remove and re-add the PIN:

• Press Windows logo key + I to open Settings.
  
• Select Accounts.
  
• Click on Sign-in options.
  
• Under PIN, remove the pin. There will be prompt to enter password, enter the password and removed the PIN.
  
• After the pin is removed, please click on
  Add to setup pin for the account.
  
• After setting up a new PIN, try to set up Windows Hello.
  

Hope it helps.

Regards,

Noor Azam S

Microsoft Community – Moderator