Windows 10: Microsoft: It's time to eliminate the password

Discus and support Microsoft: It's time to eliminate the password in Windows 10 News to solve the problem; Quick: Change your password again. Make sure it has a combination of capital letters, numbers and special characters. Wait, no. Instead, come up with a... Discussion in 'Windows 10 News' started by Brink, Dec 27, 2017.

Page 1 of 3

Brink New Member

Microsoft: It's time to eliminate the password

Quick: Change your password again. Make sure it has a combination of capital letters, numbers and special characters. Wait, no. Instead, come up with a long random phrase that you should be able to remember. Wait, no. Stop. Stop the madness! It’s time to kill the password.

This relic from the early days of computing has long outlived its usefulness, and certainly, its ability to keep criminals at bay. More than two-thirds of people use the same, usually not-very-strong password across dozens of different accounts. Weak passwords and stolen identities are the No. 1 source of data loss. Last year alone, 81 percent of major data breaches could be traced back to one individual’s compromised identity.

Stolen passwords are so commonplace among criminals that they can easily buy 1,000 usernames and passwords for less than $20 on the dark web – and can inflict a good amount of financial damage for such a small investment.

The standard approach to passwords – change them frequently, and make sure they include a combination of capital letters, numbers and special characters – is based on guidance issued in 2003 by the National Institute of Standards and Technology (NIST).

Bill Burr, the now-retired engineer who wrote the guideline, recently said that it hasn’t worked well. “It just drives people bananas and they don’t pick good passwords no matter what you do,” he told The Wall Street Journal.

Microsoft sees a better way forward. Through intelligence, innovation and partnerships, the company is helping to drive an industry-wide shift beyond passwords.
The underlying technologies are advanced, but the approach couldn’t be simpler: Instead of making you remember a list of passwords, Microsoft is making you the password.

“For several decades, the industry has focused on securing devices,” says Bret Arsenault, Microsoft’s corporate vice president and chief information security officer. “That model needs a makeover. Securing devices is important, but it’s not enough. We should also be focused on securing individuals. We can enhance your experience and security by letting you become the password.”

Microsoft began a major move to eliminate passwords with Windows Hello, introduced in Windows 10. Windows Hello is designed to work on any Windows 10 device with biometric sensors to verify your identity based on physical characteristics like a face or a fingerprint.

For example, the infrared camera in Microsoft Surface devices isn’t just taking your photo for facial identification, says Rob Lefferts, director of program management for Windows Enterprise and Security. “It’s actually building a 3D map of your face. It has depth and characteristics, and we use multi-spectrum analysis so we’re getting multiple images of your face from different perspectives.”

[youtube]uJ3W2YABZzo[/youtube]

Another approach to eliminating passwords is to incorporate other objects or devices you have with you. For example, if you’ve got an iOS or Android device, you can use the Microsoft Authenticator App to sign into your Microsoft account with a PIN (personal identification number) or fingerprint as verification. Businesses will soon be able to offer employees the same, easy phone-based authentication for corporate apps and internal resources through Azure Active Directory and Microsoft 365.

These newer systems are easy to use, and that’s crucial when it comes to encouraging people to switch from a widely adopted security system, like passwords, that may be bad, but is also familiar.

“We are encouraging users to try it, and see for themselves that it is easier to use than passwords,” says Lefferts. “I think one of the fears that people have is that new technology is just going to be more complicated, and not realize that we’ve pushed to make it simpler and better.”

Already, roughly 70 percent of Windows 10 users with biometric-enabled devices are choosing Windows Hello over traditional passwords.

Getting rid of passwords is front and center for the FIDO (Fast IDentity Online) Alliance, a nonprofit consortium of industry leaders, including Microsoft, that has developed open standards for simpler, stronger authentication. Specifications and certifications from the FIDO Alliance have enabled a broad ecosystem of hardware-, mobile- and biometrics-based authenticators that can be used with many apps and websites.

More than 250 cross-industry, global leader member organizations belong to the FIDO Alliance including Intel, Google, Samsung, Qualcomm, Visa, PayPal, eBay, Bank of America, MasterCard, American Express and Verizon. Microsoft is on the alliance’s board of directors.

“We are committed to solving this problem across the industry, which is why we’re collaborating with others in the technology industry via the Fast IDentity Online Alliance,” says Arsenault. “We’ve built a blueprint for the technology, now known as FIDO 2.0, shared it, and participated in its evolution through open collaboration with others in the alliance.”

FIDO applications are already enabled on many of the top global manufacturers’ handsets, and more than 350 products are now FIDO Certified, giving enterprises and online service providers a variety of interoperable FIDO authentication solutions to choose from.

“We wanted to replace passwords, so we needed the same kind of scalability that passwords have,” says Brett McDowell, executive director of the FIDO Alliance. “You can use a password anywhere, and we needed a technology that would work not only anywhere, but eventually, everywhere. And so we knew we needed to have an open industry standard. That was the first step.”

The next step? “We had to make sure that the secrets were never shared, so we built on the ‘proof of possession’ model established in public key cryptography as the basis of the FIDO security model,” McDowell says.

The private key stays on your personal device; “it is never shared over the internet, it is never put in a database,” McDowell says. “Instead of a password being stored on the server, only the public key for that account is ever shared with the online application so it can be used to verify what is called a ‘cryptographic signature’ from the user’s device during future authentication challenges.” This process confirms “proof of possession” of the private key without ever sharing the private key itself, he says, “thus ending phishing for credentials and/or reusing stolen credentials from a data breach.”

“You’re using a cryptographic credential bound to a device, unlocked by an on-device biometric challenge,” McDowell says. “And that is exactly how Microsoft’s Windows Hello system works.”

While Windows Hello and FIDO are key to extending password-free solutions to the general public, in many ways enterprises like Microsoft have been leading the movement. By using Azure Active Directory’s built-in identity protection in concert with Windows Hello, Microsoft has been giving commercial customers a new approach to security that uses threat intelligence and machine learning to shift the focus from securing the corporate perimeter to securing individuals and their identities.

This new way of thinking enables IT to better protect data and documents, while simultaneously reducing end user friction with simpler password-free sign ins and access to corporate apps and services wherever they are.

Arsenault says much of what Microsoft has learned about what it takes to move people beyond passwords “comes from our experiences in securing Microsoft’s own 125,000 employees in more than 100 subsidiaries worldwide, who serve over a billion people worldwide every day.”

“Like any other company or household, human error and weak passwords make the easiest targets for criminals,” Arsenault says.

Today, “the majority of Microsoft employees already log in to their computers using Windows Hello for Business instead of passwords,” he says. “Very soon we expect all of our employees will be able to go completely password free.”

Microsoft has a long history of making futuristic technology available to all. Delivering password-less technology through the world’s most popular operating system and intelligent commercial software, building companion solutions for a growing range of devices, and a willingness to share learnings with the industry along the way give Microsoft a unique ability to dramatically accelerate the transition away from the No. 1 source of data theft – passwords.

Lefferts says Microsoft is committed to helping all customers live in a “password-less world.”

“It will take time for all the parties, all the important websites and all the important line-of-business applications to adopt this technology, and it will take even more time for users, customers and organizations to make the cultural shift required so that people can really live in this new world,” he says. “But we have the blueprint for accelerating the move away from passwords. The key to success is making sure that the user experience is actually easier and better than what they have with passwords today.”

Written by: Suzanne Choney
Click to expand...

Source: What's the solution to the growing problem of passwords? You, says Microsoft | Stories

Brink, Dec 27, 2017

#1
ROY111

roy111 Win User

Style Facial Recognition Advertising In UK - 2015 - YouTube

[youtube]AmHCIz6_c4Q[/youtube]

:)

roy111, Dec 27, 2017

#2
KALPANA SHANKARAPPA

Kalpana Shankarappa Win User

How to eliminate the password requirement for the start-up, first with Cortana

Hi,

Thank you for posting the query on Microsoft Community.

I do appreciate your efforts and time. We apologize for the inconvenience.

I am sorry to know that you are unable to remove password for Cortana.

Cortana works with a Microsoft Account, so if you remove the account, then it will not work.

Cortana & search:

http://windows.microsoft.com/en-us/windows-10/cortana-search

Also, please get back to us with the detailed description of what exactly are you trying to do, so that we can assist you better.

Kalpana Shankarappa, Dec 27, 2017

#3
BULLDOGXX

BulldogXX Win User

Microsoft: It's time to eliminate the password

Eliminate passwords

If the system in question rarely (if ever) leaves the private home, a local password provides little in protection.
Click to expand...

The fact is, every time a computer connects to the internet it leaves the private home. Attackers today are as effective from thousands of miles away as if they were sitting right next to us. And since our OP is against passwords, their only user account
must have Administrator permissions. As soon as that computer is hacked, not only does the attacker have unfettered access to the system, they can also use the computer to attack other systems. And all this will happen without the OP's knowledge.

Of course, password protection is no guarantee against attack. But it's one of the many layers that goes into hardening a computer against attack. And that's the idea ... put up as many roadblocks as you can in the hope of persuading an attacker to go away.

I personally would not counsel someone to remove password protection from their computer just as I would not counsel them to remove it from their network or their router or to prevent updates or to disable their malware protection. If it was only their own
computer being put at risk, then as they say in America: "It's a free country." But it's not only the OP's computer that's at risk; it's every computer that the OP's computer can harm. That could include websites that I might need for my livelihood or that
might infect my mother's computer.

BulldogXX, Dec 27, 2017

#4
TAIRIKUOKAMI

TairikuOkami Win User

Most people do not realize, that biometric data is also a password. In order to compare it, lets say to your fingerprint, you need something to compare it to. That stored data can be stolen, just like password databases/hashes are being stolen all the time. Good luck changing your "password" afterwards. Oh wait, you can not, you are stuck with the same fingerprint/eye/face for the rest of your life. I sure would miss my 100 characters long easily changeable passwords. *Smile

TairikuOkami, Dec 27, 2017

#5
EDWIN

Edwin New Member

Kinda glitchy on Win+L...

(I think it works okay when signed out, though) *Redface

Edwin, Dec 27, 2017

#6
ELPUSHER

eLPuSHeR Win User

I have read that Windows Hello or something was hacked via a printed photograph.

eLPuSHeR, Dec 28, 2017

#7
Brink New Member

Microsoft: It's time to eliminate the password

I have read that Windows Hello or something was hacked via a printed photograph.
Click to expand...

Here's an article below about that. Scary bug.

Windows 10 security hack: Windows Hello spoofed by photo

Microsoft's Fall Creators Update for Windows 10, released in October, fixes the issue and all Windows Hello users are urged to install that update right away. After doing so, it is recommended that users enable Windows Hello's "enhanced anti-spoofing" feature and re-scan their face so the system can re-learn what they look like.
Click to expand...

*Arrow Enable Enhanced Anti-Spoofing for Windows Hello Face Authentification Security System Tutorials

Brink, Dec 28, 2017

#8
ROY111

roy111 Win User

Microsoft's Fall Creators Update for Windows 10, released in October, fixes the issue and all Windows Hello users are urged to install that update right away. After doing so, it is recommended that users enable Windows Hello's "enhanced anti-spoofing" feature and re-scan their face so the system can re-learn what they look like.
Click to expand...

Does this mean that the patch is not released for previous win 10 versions?

roy111, Dec 28, 2017

#9
Brink New Member

They didn't say, so I would assume not to be safe.

Brink, Dec 28, 2017

#10
ROY111

roy111 Win User

They didn't say, so I would assume not to be safe.
Click to expand...

Quite scary indeed then*Zip

roy111, Dec 28, 2017

#11
DENCAL

dencal Win User

Most people do not realize, that biometric data is also a password. In order to compare it, lets say to your fingerprint, you need something to compare it to. That stored data can be stolen, just like password databases/hashes are being stolen all the time. Good luck changing your "password" afterwards. Oh wait, you can not, you are stuck with the same fingerprint/eye/face for the rest of your life. I sure would miss my 100 characters long easily changeable passwords. *Smile
Click to expand...

To setup Windows Hello or Fingerprint Recognition on Surface Pro 4 you are prompted to choose either Pin or Password as backup.

dencal, Dec 28, 2017

#12
ALKAUFMANN

alkaufmann Win User

Microsoft: It's time to eliminate the password

Why is there not a webcam that can make my computer a Windows Hello compatible device? To me to me looks like Microsoft is committed to selling new expensive computers. I think I will be sticking with my very secure passwords.

alkaufmann, Dec 28, 2017

#13
Brink New Member

Why is there not a webcam that can make my computer a Windows Hello compatible device? To me to me looks like Microsoft is committed to selling new expensive computers. I think I will be sticking with my very secure passwords.
Click to expand...

Here are two:

Logitech BRIO Webcam with 4K Ultra HD video & RightLight 3 with HDR

BlasterX Senz3D - - Creative Labs (United States)

Brink, Dec 28, 2017

#14
DENCAL

dencal Win User

My understanding is the Camera must have "Intel RealSense" capability for facial recognition.
Fingerprint recognition being via the keyboard.

dencal, Dec 28, 2017

#15

(You must log in or sign up to reply here.)

Page 1 of 3

Thema:

Microsoft: It's time to eliminate the password

Loading...

Microsoft: It's time to eliminate the password - Similar Threads - Microsoft eliminate password
How do eliminate the password in logon
in Windows 10 Software and Apps
How do eliminate the password in logon: How can I eliminate the password during logon? https://answers.microsoft.com/en-us/windows/forum/all/how-do-eliminate-the-password-in-logon/b2132cf7-a9bc-432c-9ebd-5a6881bcc273
How do eliminate the password in logon
in Windows 10 Customization
How do eliminate the password in logon: How can I eliminate the password during logon? https://answers.microsoft.com/en-us/windows/forum/all/how-do-eliminate-the-password-in-logon/b2132cf7-a9bc-432c-9ebd-5a6881bcc273
How do eliminate the password in logon
in Windows 10 Gaming
How do eliminate the password in logon: How can I eliminate the password during logon? https://answers.microsoft.com/en-us/windows/forum/all/how-do-eliminate-the-password-in-logon/b2132cf7-a9bc-432c-9ebd-5a6881bcc273
eliminate password in ver. 2004
in Windows Hello & Lockscreen
eliminate password in ver. 2004: NETPLWIZ.EXE doesn't work in ver. 2004 to eliminate password https://answers.microsoft.com/en-us/windows/forum/all/eliminate-password-in-ver-2004/afd6bc95-ec0a-4586-a7af-31026c29807d
Eliminate Sign-On Password
in User Accounts and Family Safety
Eliminate Sign-On Password: I am the only person to use my Windows 10 desktop. I would like to eliminate the password request that comes up every time I restart. Thanks, cb 78001
Eliminating use of password
in User Accounts and Family Safety
Eliminating use of password: Can I get rid of having to use a password to sign in to Windows 10? 52012
Password Elimination
in Windows 10 Network and Sharing
Password Elimination: Operating a wired Ethernet LAN that connects this Windows-10 computer with other Windows-8.1, Windows-7 and Linux computers, I am constantly frustrated by demands for user IDs and passwords when attempting to access one machine from another. Such security on a local wired...
Eliminate use of password
in Windows 10 Support
Eliminate use of password: I've got Win installed with one minor problem. I don't like to use the password when I start Windows. So I did what is generally done. I got the Run box and typed in netplwiz which has always worked or me. Now it works when it makes up its mind to. Sometimes it't fine while...
Rebuild and eliminate dual boot at same time
in Windows 10 Installation and Upgrade
Rebuild and eliminate dual boot at same time: I have a computer that is a few years old and in need of a rebuild, by which I mean reformat the disk and reinstall everything. The issue is that this computer is currently a dual boot arrangement with Windows 7 first then Windows 10, Creators Upgrade. I want the end...

Log in or Sign up

Search