←back to thread

268 points tech234a | 1 comments | | HN request time: 0.273s | source
Show context
soraminazuki ◴[] No.43513090[source]
It's such an absurd lie. If Microsoft's idea of security is to force its users to authenticate online for a local account, they should never be allowed in the software industry at all. They're needlessly and dramatically increasing the attack surface of one of the most security critical software running on user devices.
replies(5): >>43513349 #>>43513354 #>>43513571 #>>43513574 #>>43514238 #
charcircuit ◴[] No.43513571[source]
Microsoft's idea of security is moving people away from local accounts protected by passwords and to Microsoft accounts protected Windows Hello.

The Windows Hello PIN is protected by the TPM. This means you can't brute force it like a password could be.

replies(2): >>43513581 #>>43513921 #
soraminazuki ◴[] No.43513581[source]
That has nothing whatsoever to do with the topic, which is forcing online authentication. You can't possibly argue that needlessly forcing online authentication makes user safe.
replies(1): >>43513608 #
charcircuit ◴[] No.43513608[source]
The topic isn't about forcing online authentication. It's about improving security from having users use a Microsoft account. The security improvement of using a Microsoft account comes from Windows Hello.
replies(2): >>43513680 #>>43520247 #
1. beeflet ◴[] No.43520247[source]
They couldn't just implement whatever biometric thing that is without making it tied to an account?