How does windows hello work to authenticate you?

Want to securely log into your computer without a password? Meet Windows Hello. Window's futuristic login technology brings biological authentication to your PC---resulting in faster, safer, and easier logins. Say goodbye to wasting your time with keyboards.

Let's find out how Windows Hello works and how do you get started?

What Is Windows Hello and What Is It Good For?

A decade ago, biometric logins were the stuff of science fiction and techno-thrillers. Today, logging into a Windows computer with just your face, eyeball, or fingerprint is a consumer-ready reality. Windows Hello rids users of the tedious login password. Let's start with the basics.

Who can use Windows Hello? Almost everyone with Windows 10 Anniversary Update! The hardware requirements come included with many modern computers. But even with older systems, several peripheral devices---for little money---provide Windows Hello.

What type of authentication does it use? You only need one of the three authentication methods: facial recognition, fingerprint, or retina. But before choosing an authentication type, find out whether or not your computer supports Windows Hello.

How to Check If Your PC Supports Windows Hello

The requirements are simple: you need the Windows 10 Anniversary Update (AU) and either an iris scanner, a fingerprint reader, or a special near-infrared 3D camera.

You can check to see if your computer already supports Windows Hello by going to Settings > Accounts > Sign-in Options. Or you can use Microsoft's direct link to your settings: ms-settings:signinoptions [blocked in Chrome]

As of early 2018, only a few mobile devices, like the Nokia Lumia 2 XL, include iris scanning (Microsoft keeps a list of compatible devices). If Windows Hello isn't available, you will see a message that says, "Windows Hello isn't available on this device."

If it isn't available, you can purchase a peripheral that adds Windows Hello functionality to your system. Of these add-on devices, there are two kinds of biometric authentication. See the section below called "Windows Hello Isn't Available on This Device" for more details.

How to Enable Windows Hello

If you do own a compatible system, it's easy to set up. Under the heading Face Recognition, click on Set up. (If your computer uses fingerprint scanning, you should choose Set up under the Fingerprint heading instead.)

To set up facial recognition, Windows shoots 3D near-infrared picture of your face. It takes into account objects like hair and glasses, so you may need to take multiple pictures of yourself to calibrate the recognition mechanism.

I've found that even wearing a hoodie or parting your hair a different way may prevent you from logging in. In that case, you would simply need to retype your password. There is no disadvantage to logging in with facial recognition.

Windows Hello's Dynamic Lock

Another great feature of Windows Hello is Dynamic Lock. We've covered Windows locking methods before, but here's a refresher: you can configure Windows to lock itself once it detects you are away. It can do this through use of a paired Bluetooth device (probably a smartphone). Once paired, if the paired device leaves Bluetooth range, the computer locks itself.

To use Dynamic Lock, first put your smartphone or tablet into Bluetooth pairing mode and then enter into Windows's Bluetooth settings. The easiest way to get there is to hit the Windows key and type in Bluetooth.

Choose Bluetooth and other device settings. Then select Add Bluetooth or other device. When prompted to choose the kind of device, select Bluetooth.

You should see your device listed here. Choose it and initiate the pairing process. After it's paired, you can now go back to Windows Hello's settings and configure Dynamic Lock.

As an aside, some of you might remember other devices that did the same thing as Dynamic Lock.

"Windows Hello Isn't Available on This Device"

If Windows Hello doesn't work, chances are your hardware isn't compatible. That means your system lacks iris scanning, fingerprint scanning, or a near-infrared 3D camera. Unfortunately, you cannot buy an iris scanner yet.

Add a Fingerprint Scanner to Windows 10

The cheapest and most secure option is a fingerprint scanner. Fingerprint scanners recognize the unique topography of the tip of a finger or thumb. Of the scanners out there, all do the same thing. These are all functionally identical, though. The least expensive option is also the most affordable method of adding Windows Hello compatibility.

The device plugs into a USB port and after the drivers finish installing, the user only needs to configure their fingerprint in Windows. From then on, you can log into your computer with just a touch.

There are also two alternatives to a USB dongle scanner. Microsoft makes a first-party biometric scanner combined with a keyboard.

In addition to a keyboard, mice with integrated scanners will soon arrive. Unfortunately, the ones that I've seen on Amazon aren't Windows Hello compatible.

Overall, the fingerprint scanner offers the best security. While the facial recognition camera doubles as a webcam, they tend to be pricey and have a false authentication rate---according to Microsoft---of less than 1%.

It's also the cheapest method of getting Windows Hello working. There are more expensive devices that add fingerprint recognition, but they do the same thing as the cheap models.

Add a Facial Recognition Camera

Facial recognition scanners come in several different models. Windows Hello compatible webcams include products from Logitech, Microsoft, and more. Out of these, the least expensive is the Mouse or LilBit webcams (which lack a microphone).

In the high-end market, there are several options. However, in my opinion, the Razer Stargazer is extremely overpriced and the Kinect 2.0 doesn't have enough features to justify its price.

Logitech's deluxe Brio webcam includes both Windows Hello support and noise-canceling microphones. However, its cost falls outside of most budgets. And reviews haven't been great.

Personally, I think that the best option if you prefer a fingerprint scanner is a USB dongle. It's cheap, easy to use, and doesn't force you to use any particular mouse or keyboard.

How Secure and Private Is Windows Hello?

According to Microsoft's privacy policy, your privacy is protected in two ways:

First, if you use either fingerprint or face recognition authentication, Microsoft does not transfer (according to them) the raw data of either your fingerprint or photograph over the internet.

In fact, it doesn't even store the raw data. Rather than keeping your fingerprint or photo, Windows creates a digital abstraction. This information is not recognizable to human beings and can only be interpreted with a machine.

Second, while some user data is transferred over the internet, it's encrypted so it cannot be intercepted through man-in-the-middle attacks. The encryption is fairly strong so even if it were intercepted, the attacker would only get access to a hash of data.

In the end, if you trust Microsoft (you probably shouldn't) and are concerned that biometric information may be used against you by criminal parties, Windows Hello might be considered safe. If you are concerned that Microsoft may use your data for profit, stay away from Windows Hello. However, if you aren't concerned, there's nothing inherently flawed about the way Microsoft stores and transfers your data.

Is Windows Hello Worth Using?

For desktop users, Windows Hello is the easiest method of getting your computer set up with biometric authentication. Even if you don't have the hardware, it's possible to add it by buying a Windows Hello-enabled fingerprint reader or face scanner.

For most users, I recommend a fingerprint scanner. They're tiny and plug into USB ports, which makes them compatible with almost all computers. For the money, the best option out there is the iDOO fingerprint reader or the Eikon Mini.

But before you start with Windows Hello, make it a priority to review the other security features you can set up on your system.