There are different ways to take and process images for facial recognition. “Microsoft was great to work with and produced mitigations, but the deeper problem itself about trust between the computer and the camera stays there.” “A really motivated attacker could do those things,” says Tsarfati. Which means that with one straight-on infrared image of a target's face and one black frame, the researchers found that they could unlock the victim's Windows Hello–protected device. But the system, it turns out, doesn't even look at RGB data. Windows Hello facial recognition works only with webcams that have an infrared sensor in addition to the regular RGB sensor. That's because you can't trust any old webcam to offer robust protections in how it collects and transmits data. Where some might see ease of adoption, though, researchers from the security firm CyberArk saw potential vulnerability. But because Windows hardware is so diverse, Hello facial recognition works with an array of third-party webcams. Apple only lets you use FaceID with the cameras embedded in recent iPhones and iPads, and it's still not supported on Macs at all. Services like Apple's FaceID have made facial-recognition authentication more commonplace in recent years, with Windows Hello driving adoption even farther.

But a new method for duping Microsoft's Windows Hello facial-recognition system shows that a little hardware fiddling can trick the system into unlocking when it shouldn't. Biometric authentication is a key piece of the tech industry's plans to make the world password-less.

Microsoft hello