News for hackers. Stuff that matters.

A comment on Microsoft has removed the “use offline account” option when installing Windows. Parent comment

Re:Microsoft has removed the “use offline account” option wh... by tzs on Saturday September 28, 2019 @10:43PM (#21104683)
> ...and from what I can tell, their online account security is craptastic.

I'm not convinced that their offline security is good, either.

I sometimes will pick up my Surface Pro 4 and disconnect it from the charger. Disconnecting from the charger usually (but not always...not sure what determines it) wakes it. It then turns on their equivalent of Apple's Face ID, and tries to log in.

Sometimes I don't actually want that yet, as I just picked it up to take it somewhere else. So I'll hit the power button to put it back to sleep. The screen blanks...and then sometimes it quickly comes back, logged in.

The thing is I've sometimes had it do this when I've been careful to have my face out of view, holding it so I can only barely see the screen around the edge to see if disconnecting power will wake it up and I'll need to hit power to put it back to sleep.

This doesn't happen all the time, but it has happened several times, leading me to wonder if there is some sort of glitch if you interrupt a face-based login attempt at just the right time via the power button causing it to think it logged in.

Anyone else seen this?

[ Parent | on HN ]
Re:Microsoft has removed the “use offline account” option wh... by spsful on Sunday September 29, 2019 @12:21AM (#21105063)
Happened to me all the time when I used SP4. However, biometrics can be disabled through settings or group policy!
[ Parent | on HN ]
Re:Microsoft has removed the “use offline account” option wh... by orev on Sunday September 29, 2019 @12:17AM (#21105045)
Face logon takes some seconds to initialize, and if you interrupt it it gets confused. But the solution to your issue is to have the type cover closed when you unplug it.
[ Parent | on HN ]
Re:Microsoft has removed the “use offline account” option wh... by Normal_gaussian on Sunday September 29, 2019 @05:57AM (#21106165)
That is hardly a solution to a security issue. I can't ensure the burglar keeps the cover closed
[ Parent | on HN ]
Re:Microsoft has removed the “use offline account” option wh... by richardwhiuk on Sunday September 29, 2019 @07:02AM (#21106354)
The burglar won't have your face?
[ Parent | on HN ]
Re:Microsoft has removed the “use offline account” option wh... by rovr138 on Sunday September 29, 2019 @02:48PM (#21108883)
I’m a sensitive location.
[ Parent | on HN ]
Re:Microsoft has removed the “use offline account” option wh... by sarcasmOrTears on Sunday September 29, 2019 @12:10AM (#21105024)
That's why I gave it back after a week. That and updates.
[ Parent | on HN ]
Re:Microsoft has removed the “use offline account” option wh... by sieabahlpark on Sunday September 29, 2019 @12:32AM (#21105099)
> I'm not convinced that their offline security is good, either.

If they have physical access to the device there isn't much you can do anyway.

[ Parent | on HN ]
Re:Microsoft has removed the “use offline account” option wh... by jdnenej on Sunday September 29, 2019 @03:15AM (#21105604)
You can with encryption and not using face unlock.
[ Parent | on HN ]
Re:Microsoft has removed the “use offline account” option wh... by e12e on Sunday September 29, 2019 @06:14AM (#21106205)
As far as I can figure out, you also need to opt for manually unlocking bitlocker via USB key (prone to copy/theft) or via typing in a passphrase (inconvenient) in order to safeguard the encryption key.

Windows will otherwise use hsm to store your key (as evidenced by eg face unlock working) - it's not at all clear how that could possibly be secure if an attacker steals your device?

[ Parent | on HN ]
Re:Microsoft has removed the “use offline account” option wh... by jasonjayr on Sunday September 29, 2019 @06:56AM (#21106329)
If the key is in the HSM, then what's protecting your data is the trust in the boot chain not being broken, and the OS login not not being compromised (theoretically).

Booting an alternate OS, or removing the media will result in the HSM not giving up the key, and rendering the drive unusable for all attackers except those able to physically probe the HSM chips and extract keys. (theoretically)

[ Parent | on HN ]
Re:Microsoft has removed the “use offline account” option wh... by e12e on Sunday September 29, 2019 @07:10AM (#21106384)
Right. It's not really the hsm itself I worry about (although as we saw with the Xbox hack people are able to do some crazy stuff) , but the possibility of working around/breaking the os login manager - manipulating the camera or hooking up a custom "keyboard" or some such.

For example i have trouble trusting pin login against brute force when the attacker has unrestricted physical access - including the possibility of replacing/manipulating the ram chips etc.

[ Parent | on HN ]