Windows Hello bypassed using infrared image • Hacker News Board

Re: Windows Hello bypassed using infrared image

#51

Post by dbbk » Tue, Jul 20, 2021, 6:37 PM UTC

vitorgrs wrote: post #35

SilverRed wrote: post #21

Earlier quoted context omitted.

The problem is that Apple does facial recognition and does it in a semi secure way which builds trust in the technology. Then microsoft and samsung jam in the feature without any of the security considerations and ride off the trust Apple built in it. It's completely outrageous that MS thought it was acceptable to do facial recognition using a basic webcam.

Windows Hello exists before Apple's Face ID. 2 years before Apple.

That's not really relevant to the issue at hand though

Re: Windows Hello bypassed using infrared image

#52

Post by mavhc » Tue, Jul 20, 2021, 9:01 PM UTC

colejohnson66 wrote: post #48

mavhc wrote: post #37

Earlier quoted context omitted.

What input device do you use to accept the prompt?

A PS/2 mouse would work, but who has those anymore?

Plus you'd have to teach people to turn off their computers before plugging them in, which would be hard with Windows these days, when Shutdown is actually Hibernate

Re: Windows Hello bypassed using infrared image

#53

Post by rasz » Tue, Jul 20, 2021, 9:40 PM UTC

dchest wrote: post #14

chmod775 wrote: post #7

If you're using that as your sole authentication mechanism, then you're not encrypting your data with a password. It's already game over. These kinds of things of 'security'* features can't be considered protection for the valuable data on your computer, or the e-commerce account you're currently signed in on. This stuff is for preventing Steven from making a funny Facebook post in your name (he'll find a way anyways…

Facial and fingerprint authentication is the most successful and practical security feature protecting billions of computers which would have been unprotected otherwise. It should not be dismissed like that, and I’m glad the work is being done to find and fix vulnerabilities.

>successful and practical

In marketing sense. You leave your fingerprints all over the keyboard, and I can record your face freely.

Re: Windows Hello bypassed using infrared image

#54

Post by rasz » Tue, Jul 20, 2021, 9:46 PM UTC

djrogers wrote: post #50

user-the-name wrote: post #42

Earlier quoted context omitted.

A "physically compromised" iPhone will still not let you in, no matter what devices you plug into it, including removing the camera module and replacing it.

I think this comment is being downvoted unfairly - yes, there are mechanisms to get into an iPhone with physical access (see greykey) - but those rely on leveraging a vulnerability to allow brute forcing the PIN, they do not break FaceID.

https://appleinsider.com/articles/17/11/28/apples-face-id-wi...

https://www.macrumors.com/2019/08/08/face-id-bypassed-glasse...

Re: Windows Hello bypassed using infrared image

#55

Post by SilverRed » Wed, Jul 21, 2021, 12:14 AM UTC

vitorgrs wrote: post #35

SilverRed wrote: post #21

Earlier quoted context omitted.

The problem is that Apple does facial recognition and does it in a semi secure way which builds trust in the technology. Then microsoft and samsung jam in the feature without any of the security considerations and ride off the trust Apple built in it. It's completely outrageous that MS thought it was acceptable to do facial recognition using a basic webcam.

Windows Hello exists before Apple's Face ID. 2 years before Apple.

That doesn't really mean anything. It's just another data point about how microsoft rushes out features which are not secure. Android also had face unlock years ago with the nexus 7 and it was even less secure than the current systems.

Very few companies actually care about security over flashy marketing features.

Re: Windows Hello bypassed using infrared image

#56

Post by gregmac » Wed, Jul 21, 2021, 9:36 PM UTC

ivegotnoaccount wrote: post #27

nitrogen wrote: post #5

Earlier quoted context omitted.

"Please press this key sequence, then type your password, on the newly attached keyboard to enable it for use."

Then you will (probably) get malwares that open a window in fullscreen that imitates that prompt and sends data to a server. You probably could add some kind of fingerprint that allow identifying the legit prompts, but since it is not done with login screens...

Aside from already having malware making this irrelevant, if you didn't just physically attach a new keyboard, the message about a new keyboard is also going to seem very suspicious.

Re: Windows Hello bypassed using infrared image

#57

Post by gregmac » Thu, Jul 22, 2021, 12:50 AM UTC

tyingq wrote: post #26

gregmac wrote: post #25

Earlier quoted context omitted.

I don't see why you need context? > A device changing would be indistinguishable from one being removed and a new one going in. Or future "rubby duckies" could emulate a hub, and add multiple devices, all operating simultaneuously. In all of these cases, the system should show a prompt asking the user for authorization. Hopefully in a way that makes it clear if they didn't just physically attach a new keyboard, they…

Yes, you could prompt for every USB device detection. You would have to do that on boot too, though, which would probably give users security notice fatigue. There's basically no persistence, serial numbers, etc.

Only initially. I guess maybe I wasn't clear in my original post, but my idea was always that the system would remember any authorized device (presumably by VID+PID+capabilities, but maybe also serial or other identifying info if the device+OS supports it). You'd only get the UI prompt the very first time you plug in a new keyboard -- after that, you can plug it in at will and it continues to work. This is also why I mentioned about VID/PID brute force attacks.

It would be rare to see multiple devices at once -- eg: the very first boot, or plugging in a new complex device like a dock -- but the experience of this hinges on having the right UI. Having a series of pop-ups like "Do you accept Generic USB Hub 06 (connected to Root USB Hub 2)?" is going to cause them all to be ignored, but, for example, showing a tree of devices and making it easy to accept all at once would probably be ok. And hubs in particular may be a special case, where you don't bother to prompt, but I don't know if that opens an attack vector.