FIDO2 authenticates a user by verifying a private key with a public key registered in the FIDO server at the time of initial login. FIDO2 provides strong, attested, asymmetric public key-based credentials for the authentication of users. While a password authenticates a user based on what the user knows, FIDO2 is based on who the user is and what the user has. IntroductionĪ new standard, Fast IDentity Online version two (FIDO2), provides an alternative to password-based authentication by accommodating high-level yet easy-to-use security for user validation. We consider the possibility of such an attack to be serious and harmful to our society and demand immediate attention for remediation. In the proposed attack, an attacker extracts authentication data from a device to impersonate a victim in his or her Microsoft online account. We propose a migration attack to compromise Windows Hello’s security. The results show that, on a hardware-unsupported device, the authentication data for Windows Hello is not properly protected. We present the first detailed analysis of Windows Hello’s security. This paper aims to examine the security of Windows Hello on a device where hardware protection is unavailable. Hardware protection is essential for Window Hello’s security. Windows Hello is a Fast IDentity Online- (FIDO-) based new login system for Windows 10, which provides a single sign-on (SSO) service to diverse online applications.

Windows hello for business fido2