Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Windows Hello bypassed using infrared image

therecord.media

Post reply on HN
Print view View original

31–40 of 57 posts

Re: Windows Hello bypassed using infrared image

#31

Post by stinos »

SilverRed wrote: post #21
chmod775 wrote: post #7

If you're using that as your sole authentication mechanism, then you're not encrypting your data with a password. It's already game over. These kinds of things of 'security'* features can't be considered protection for the valuable data on your computer, or the e-commerce account you're currently signed in on. This stuff is for preventing Steven from making a funny Facebook post in your name (he'll find a way anyways…

The problem is that Apple does facial recognition and does it in a semi secure way which builds trust in the technology. Then microsoft and samsung jam in the feature without any of the security considerations and ride off the trust Apple built in it. It's completely outrageous that MS thought it was acceptable to do facial recognition using a basic webcam.

Can you explain why Apple's implementation is semi secure and others' implementations aren't? All of them have been bypassed at one point or another IIRC but that's probably not what you mean?

(also: if it's semi secure then being able to build trust based on that means the other part is PR I guess, outrageous as well?)

Re: Windows Hello bypassed using infrared image

#32

Post by quenix »

stinos wrote: post #31
SilverRed wrote: post #21

Earlier quoted context omitted.

The problem is that Apple does facial recognition and does it in a semi secure way which builds trust in the technology. Then microsoft and samsung jam in the feature without any of the security considerations and ride off the trust Apple built in it. It's completely outrageous that MS thought it was acceptable to do facial recognition using a basic webcam.

Can you explain why Apple's implementation is semi secure and others' implementations aren't? All of them have been bypassed at one point or another IIRC but that's probably not what you mean? (also: if it's semi secure then being able to build trust based on that means the other part is PR I guess, outrageous as well?)

A few thoughts:

Apple's Face ID takes a 2-dimensional infrared image of your face as well as projects 30,000 IR dots to form a 3D depth map of the face. It feeds this into a NN in a separate Secure Enclave processor to determine whether the face is attentive and authorised. I believe they also implement specific NNs just to perform anti-spoofing, both physical and digital.

This is contrasted to Samsung and Microsoft's solutions which take a picture and try to match it.

Apple's Platform Security Guide on Face & Touch ID [0] is an interesting read.

[0]: https://support.apple.com/en-gb/guide/security/sec067eb0c9e/...

Re: Windows Hello bypassed using infrared image

#33

Post by Sander_Marechal »

chmod775 wrote: post #7

If you're using that as your sole authentication mechanism, then you're not encrypting your data with a password. It's already game over. These kinds of things of 'security'* features can't be considered protection for the valuable data on your computer, or the e-commerce account you're currently signed in on. This stuff is for preventing Steven from making a funny Facebook post in your name (he'll find a way anyways…

Biometrics should equate usernames, not passwords

Re: Windows Hello bypassed using infrared image

#34

Post by nasut »

ohazi wrote: post #19
gruez wrote: post #11

Earlier quoted context omitted.

What you'd described would require each USB device to cryptographically sign its communications with an unique key. AFAIK USB doesn't have this, but thunderbolt does (it's called "secure connect"). Even if it does get implemented though, it probably won't help much because most users can be social engineered into trusting the new device.

The common USB device classes (video device, HID keyboard/mouse, etc.) don't have this, but anybody can define a new device class that does. It seems like maybe Microsoft should have required something like this for Windows Hello cameras, if they intended for people to use the hardware as a single factor authenticator. i.e. the camera generates internal crypto keys and tells Windows about them when you set up Windows…

” They could have provided a reprovisioning tool, but it's Apple, so they didn't.”

They did

Re: Windows Hello bypassed using infrared image

#35

Post by vitorgrs »

SilverRed wrote: post #21
chmod775 wrote: post #7

If you're using that as your sole authentication mechanism, then you're not encrypting your data with a password. It's already game over. These kinds of things of 'security'* features can't be considered protection for the valuable data on your computer, or the e-commerce account you're currently signed in on. This stuff is for preventing Steven from making a funny Facebook post in your name (he'll find a way anyways…

The problem is that Apple does facial recognition and does it in a semi secure way which builds trust in the technology. Then microsoft and samsung jam in the feature without any of the security considerations and ride off the trust Apple built in it. It's completely outrageous that MS thought it was acceptable to do facial recognition using a basic webcam.

Windows Hello exists before Apple's Face ID. 2 years before Apple.

Re: Windows Hello bypassed using infrared image

#36

Post by dhx »

gruez wrote: post #11
tyingq wrote: post #10

Earlier quoted context omitted.

>if a "keyboard" suddenly is presenting itself as storage, that causes a prompt I'm not clear on how you would know it was the keyboard changing identities and not just a new device. Does the USB protocol provide anything where you would know, assuming devices can change Base Class, VID, PID, and so on? For that matter, I don't think it needs to change. It can just emulate a hub and present both.

What you'd described would require each USB device to cryptographically sign its communications with an unique key. AFAIK USB doesn't have this, but thunderbolt does (it's called "secure connect"). Even if it does get implemented though, it probably won't help much because most users can be social engineered into trusting the new device.

There exists the USB Authentication Specification Rev. 1.0 [1] which states in section 3.3:

"A private key used by one Authentication Responder shall not be used by any other Authentication Responders. For example, one instance of a USB PD power supply cannot have the same private key as another instance of the USB PD power supply, even if they are otherwise identical model."

[1] https://usb.org/document-library/usb-authentication-specific...

Re: Windows Hello bypassed using infrared image

#37

Post by mavhc »

tyingq wrote: post #26
gregmac wrote: post #25

Earlier quoted context omitted.

I don't see why you need context? > A device changing would be indistinguishable from one being removed and a new one going in. Or future "rubby duckies" could emulate a hub, and add multiple devices, all operating simultaneuously. In all of these cases, the system should show a prompt asking the user for authorization. Hopefully in a way that makes it clear if they didn't just physically attach a new keyboard, they…

Yes, you could prompt for every USB device detection. You would have to do that on boot too, though, which would probably give users security notice fatigue. There's basically no persistence, serial numbers, etc.

What input device do you use to accept the prompt?

Re: Windows Hello bypassed using infrared image

#38

Post by mavhc »

quenix wrote: post #32
stinos wrote: post #31

Earlier quoted context omitted.

Can you explain why Apple's implementation is semi secure and others' implementations aren't? All of them have been bypassed at one point or another IIRC but that's probably not what you mean? (also: if it's semi secure then being able to build trust based on that means the other part is PR I guess, outrageous as well?)

A few thoughts: Apple's Face ID takes a 2-dimensional infrared image of your face as well as projects 30,000 IR dots to form a 3D depth map of the face. It feeds this into a NN in a separate Secure Enclave processor to determine whether the face is attentive and authorised. I believe they also implement specific NNs just to perform anti-spoofing, both physical and digital. This is contrasted to Samsung and Microsoft'…

iPhone X(box Kinect)

Still nowhere near as secure as they make out though

Re: Windows Hello bypassed using infrared image

#39

Post by djxfade »

nasut wrote: post #34
ohazi wrote: post #19

Earlier quoted context omitted.

The common USB device classes (video device, HID keyboard/mouse, etc.) don't have this, but anybody can define a new device class that does. It seems like maybe Microsoft should have required something like this for Windows Hello cameras, if they intended for people to use the hardware as a single factor authenticator. i.e. the camera generates internal crypto keys and tells Windows about them when you set up Windows…

” They could have provided a reprovisioning tool, but it's Apple, so they didn't.” They did

Source?

Re: Windows Hello bypassed using infrared image

#40

Post by ohazi »

nasut wrote: post #34
ohazi wrote: post #19

Earlier quoted context omitted.

The common USB device classes (video device, HID keyboard/mouse, etc.) don't have this, but anybody can define a new device class that does. It seems like maybe Microsoft should have required something like this for Windows Hello cameras, if they intended for people to use the hardware as a single factor authenticator. i.e. the camera generates internal crypto keys and tells Windows about them when you set up Windows…

” They could have provided a reprovisioning tool, but it's Apple, so they didn't.” They did

They most certainly did not.

https://www.ifixit.com/News/9020/no-fix-iphone-7-home-button

https://www.ifixit.com/Guide/MacBook+Air+13-Inch+Retina+Disp...

Post reply on HN