9

Hi I have a Lenovo laptop encrypted with Bitlocker, which I also use a fingerprint scanner with. Bear in mind I'm not working with super-secure information, more the level that a developer/manager for a business would have. What are the potential issues with fingerprint scanners and Windows 10 Hello

  • Of the kind built into a business laptop
  • Of the external USB kind

The kind of things I'm curious about are:

  • Is there malware that can intercept the external USB type of scanner as it sends the fingerprint to the computer
  • Where does Windows 10 Hello store the fingerprint information
  • Are there are settings in Windows Hello which sync it to the cloud/AD controller on the network inadvertently
Improve this question

1 Answer 1

Reset to default
4

Good to hear to are considering biometrics and want to learn more about them.

Using a fingerprint scanner is generally considered (in a windows hello context) to be a convenience not an increase in security, however, I can envision several situations where security could be increased or decreased depending on the situation.

Potential issues

  • Fingerprint scanner are generally considered to be spoofable, meaning a sophisticated attacker could make a fake fingerprint or even use some other trickery to login as you. See this article
  • If someone makes a fake fingerprint of you,you can't change your fingerprint. This is a problem with all biometrics, they are tied to you and unchangable.

As to some of your other Questions:

  • It doesn't matter if you use a external USB one or the built in one on your computer, they work the same way. If malware is on your computer intercepting your devices then you are already compromised and the app could be recording your keystrokes or pulling your passwords directly.

  • Windows Hello treats your biometric data about equivalently to the "PIN" on your computer, a local replacement for your password. The biometric data is local to your computer, and is not synced to the cloud. Microsoft considers that someone is physically present attempting to login to your device to be a factor in the multi factor authentication scheme that justifies their windows hello approach.

  • Basically, if you have an attacker physically attacking your device between your uses, you are in trouble. They could break your fingerprint scanner, and install a tiny camera to record you typing in your password. Or physically insert a keylogger or a host of other attacks.

  • It could increase your security if you setup the fingerprint in a secure location and only after use your fingerprint in public places, then an observing attacker would not be able to get your password from recording you logging in for example.

Improve this answer
4
  • I assume Windows Hello is encrypted - does it get stored on the TPM if present? Also I believe hardware needs to be specially certified for use with Windows Hello, is that correct? The scenarios I am most concerned with are more standard data protection i.e. where is the data stored, and vectors that an average business would have such as malware on the client machine.
    – user1102550
    Commented Mar 27, 2017 at 19:34
  • 1
    Windows hello data is not stored on the TPM, it is encrypted and kept on your hard disk, in a propitiatory format similar to the PIN data. it also doesn't deal specifically with data protection and only windows login. Bitlocker is doing your data protection (from theft) and is using the TPM (the default config). None of the things we are talking about defend against malware or data loss associated with such.
    – Aaron
    Commented Mar 27, 2017 at 19:41
  • 1
    Sorry I meant "data protection" in the sense of the UK Data Protection Act. That is, you need to know where personal information is being stored. Hence the questions about syncing to AD/Cloud. Cheers.
    – user1102550
    Commented Mar 27, 2017 at 19:44
  • Ah ok, then you should see here for microsoft privacy statment on it, but the short is that all biometric personal info is kept locally on your computer in an encrypted format. None is synced anywhere (and you can't choose otherwise)
    – Aaron
    Commented Mar 27, 2017 at 19:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .