Microsoft: Biometrics are the future of Windows 10 security

With the use of passwords coming under increased scrutiny, Microsoft is taking steps to move beyond them in Windows 10. Its biggest move: Joining the FIDO (Fast Identity Online) Alliance and adding support for the biometrics technology in the upcoming upgrade of the OS, which has been slated to ship this year.

“Transitioning away from passwords and to a stronger form of identity is one of the great challenges that we face in online computing, and we believe FIDO authentication, which is the subject of great discussion here at the White House [cybersecurity] summit, is the pathway to success,” said Microsoft’s Dustin Ingalls, in a blog post late last week.

With Windows 10, Windows devices and Microsoft-owned and partner SaaS services supported by Azure Active Directory authentication can be accessed via an enterprise-grade two-factor authentication solution — without a password, Ingalls said. Windows 10 will include Active Directory integration for on-premise scenarios and Microsoft Account integration for consumer services like Outlook.com and OneDrive. Ingalls said that Microsoft has contributed design inputs to the FIDO Alliance that will be incorporated into the FIDO 2.0 specification. 

“This new standard for security devices and browser plug-ins will allow any website or cloud application to interface with a broad variety of existing and future FIDO-enabled devices that the user has for online security,” the FIDO Alliance site states. FIDO specifications cite a password-less experience, with FIDO protocols leveraging public key cryptography and resistance to phishing.

The subject of passwords was the focus of a panel discussion at the White House Summit on Cyber Security and Consumer Protection last week at Stanford University, with Lorrie Cranor, a faculty member at Carnegie Mellon University, discussing the university’s research in the area. CMU found obstacles with authentication methodologies, and having users change passwords frequently means passwords get weaker and weaker, she said. Cranor even wore a dress festooned with the 500 most-common passwords, such as “tinkerbell.”

CMU also has looked at smartphone biometrics, including facial recognition. “We found a lot of usability problems with face recognition, which basically doesn’t work in the dark,” Cranor said.