Microsoft’s Windows Hello fingerprint authentication has been bypassed

This is why I use Linux, the fingerprint device wouldn't be supported so this wouldn't be an issue /s

Reading the article it doesn’t sound like it’s Microsoft’s issue but the vendor’s implementation and lack of using the secure communication protocol.

It stopped working when I uninstalled Edge, and so did the face recognition. So it depends on WebView or some shit. Pretty sure it’s Microsoft's way of getting around the new EU regulations and hastily integrating the browser into everything, regardless of it making sense or improving security. like they did with 98 after the browser anti-competitiveness lawsuit.

Stop using biometrics for authentication!!!!!

Edit: lots of opinions below. Biometrics are a username, a thing you are. Finger printed can be taken from your laptop with a little powder and masking tape.

Use an authentacator app or security key kids!!

Surprise. Or not.

Who is surprised? Are you surprised?

im all for the something you have + something you are , pb&j relationship, but i dont think lathering biometrics on top is a good idea,far too many spy movies have shown Tom Cruise doing the MOST for pictures of eyeballs and fingerprints for me to ever trust this type of auth

This is the best summary I could come up with:

Microsoft’s Offensive Research and Security Engineering (MORSE) asked Blackwing Intelligence to evaluate the security of fingerprint sensors, and the researchers provided their findings in a presentation at Microsoft’s BlueHat conference in October.

The team identified popular fingerprint sensors from Goodix, Synaptics, and ELAN as targets for their research, with a newly-published blog post detailing the in-depth process of building a USB device that can perform a man-in-the-middle (MitM) attack.

Blackwing Intelligence researchers reverse engineered both software and hardware, and discovered cryptographic implementation flaws in a custom TLS on the Synaptics sensor.

The complicated process to bypass Windows Hello also involved decoding and reimplementing proprietary protocols.

The researchers found that Microsoft’s SDCP protection wasn’t enabled on two of the three devices they targeted.

Blackwing Intelligence now recommends that OEMs make sure SDCP is enabled and ensure the fingerprint sensor implementation is audited by a qualified expert.

The original article contains 474 words, the summary contains 145 words. Saved 69%. I'm a bot and I'm open source!

Of course it has. Microsoft Windows.

The Surface Pro X has a fingerprint reader? Is it on the keyboard or something? Mine sure doesn't have one.

No shit