The world has been trying its best to move away from using passwords and toward alternatives like passkey, fingerprints, facial recognition, and other forms of passwordless options through solutions like Windows Hello. Passwords are usually still associated in one form or another but it allows multi-layered protection in so many cases. But security researchers have found a way to circumvent these methods (at least, partially).
The researchers at Blackwing Intelligence have been working with Microsoft to put these methods to the test and this is when they came up with their unfortunate results. Someone could develop a USB device capable of breaking through Windows Hello’s defenses.
Windows Hello is Microsoft’s 2FA/MFA solution for using alternative credentials that can be used to log into the operating system or any service that supports making use of it. This specifically affects those making use of fingerprints as an option for logging into Windows Hello.
If a user has set up Windows Hello’s fingerprint option, their system would be affected by this newly found vulnerability. Thankfully, it isn’t an easy-to-accomplish attack. But it does show that these password alternatives aren’t as secure as companies have banked on.
The findings were partially shared during Microsoft’s BlueHat event, bringing everything to light. Although it is unfortunate to hear about another flaw in the future of security and a world that will someday be without passwords, it is a plus as well. This brings these issues into the light before they can be taken advantage of by wrongdoers. Helping to secure the way ahead that much more.
However, the disadvantage of running into things like this is that it reminds us that it isn’t the solve-everything answer to getting away from passwords so quickly (or maybe, at all). Another example of how relying on a one-step process of logging into something isn’t as safe regardless of the method (at least, for now). And that it is smart to layer yourself with multiple forms of authentication still.
