MICROSOFT_PRESS_EBOOK_INTRODUCING_WINDOWS_10

As part of this architectural change, Windows 10 implements new services called Microsoft Passport,
bringing identity protection to a new level. This feature replaces passwords with strong two-factor
authentication that uses an enrolled device as one factor and biometric information (Windows Hello)
or a PIN as the second factor. The associated services are available on all Windows 10 editions, as you
can see from Figure 5-4, and are enabled as needed.
FIGURE 5-4 These two Microsoft Passport services are key to a revolution in identity that eliminates the need for
regular entry of passwords on compatible devices.
Although multifactor security is available for many devices and services today, it’s limited to
solutions such as smartcards and authenticator apps on devices such as smartphones. Windows 10
builds multifactor authentication into the operating system and device itself, eliminating the need
for additional hardware security peripherals.
The crucial step with Windows 10 is enrolling a device with a Microsoft account, an Active Directory
account, a Microsoft Azure Active Directory (AD) account, or a non-Microsoft service that supports
Fast IDentity Online (FIDO) authentication. (The FIDO standard is supported by many banks and existing
authentication providers such as RSA.) Once enrolled, the device itself becomes one of the factors
required for authentication. The second factor is a PIN (the default option) or, on systems with appropriate
hardware support, biometric authentication, such as fingerprint recognition, facial recognition,
or an iris scan.
Existing fingerprint readers work with the new authentication measures. For facial recognition,
new hardware that includes infrared capabilities (for antispoofing purposes) is required. Microsoft’s
Surface Pro 4, for example, includes a built-in camera that is compatible with Windows Hello; a Type
Cover with integrated fingerprint reader is also available as an option. After the initial setup, you
can configure a Surface Pro 4 to unlock automatically when it recognizes the enrolled user’s face, as
shown in Figure 5-5.
66 CHAPTER 5 Security and privacy in Windows 10