Windows 10: Hands-On with Windows Hello Facial Recognition

Among the many advances in Windows 10 is a new security feature called Windows Hello, which uses various biometric means, including facial recognition, to speed user sign-in. And sure enough, as Microsoft has demonstrated, Windows Hello facial recognition is wicked fast: in my own tests, the system identifies me and signs me in in less than a second.

That’s impressive. But Windows Hello—in all of its forms—requires special hardware that most people probably don’t have. And that will limit its usefulness for the short term, though I do expect many new PCs—and phones, too—to ship with Windows Hello-compatible hardware soon. Too, there will be add-on peripherals, like the Intel RealSense Developer Kit camera I used to test Windows Hello.

From a high-level, Windows Hello is a new way to sign-in to your Windows PC/device. It augments all the previous sign-in combinations (different account types with no password, password, and, in Windows 8 and newer PIN and picture password) with new forms of authentication that build on, rather than replace, the reviled password. (Microsoft is also working to eliminate passwords entirely, but this is an effort that will take quite some time, I’d imagine.)

The design tenets for Windows Hello—that it be fast, secure and delightful—are obvious enough and appear to be met by the final product. Some people are a bit worried that facial recognition, in particular, is not secure. But Microsoft says that Windows Hello is enterprise-class security, and that with facial recognition in particular, the information is saved locally and encrypted, and never sent over the Internet. Furthermore, it doesn’t use a picture of your face—since someone could theoretically hold up a photo of you to thwart the system—or build a 3D model of your face. This system cannot be reverse-engineered, Microsoft says.

There are three types of Windows Hello sign-in, of which I’ve tried two:

Fingerprint scan. This uses a swipe- or press-based fingerprint scanner, like Lenovo, HP and others have been implementing on their PCs for years. To date, configuring and managing fingerprint-style sign-ins has traditionally been done via third-party software, though Microsoft added this to Windows previously and has brought it into the Windows Hello fold with Windows 10. I first tested Windows Hello with the fingerprint scanner on a Lenovo ThinkPad X1 almost two months ago.

Facial scan. This sign-in requires special camera hardware with IR capabilities—so it can work in any lighting, including pitch black darkness—and cannot be retrofitted to existing webcams, or to Kinect. (I could see a future Kinect peripheral adding Windows Hello support.) Today, you pretty much need an Intel RealSense camera to sign-in with Windows Hello. This camera is shipping in a variety of PCs, including some from ASUS, Dell, HP and Lenovo. And you can order a developer kit directly from Intel for $100 if you want, though be aware that is has some onerous hardware requirements (such as needing a 4th generation or newer Intel Core processor). I recently did purchase this camera for Windows Hello testing.

Iris scan. This third sign-in type is in some ways the most mysterious and, it seems to me without having actually used it, least convenient. With an iris scanner, you must place your eye fairly close to a compatible camera so that it can scan your eye and identify you, a la Mission Impossible and numerous other movie thrillers. The coming Lumia 940/950 XL will include a Windows Hello-compatible iris scanner, but I’m not aware of any other implementations.

In each case, you use a wizard to enroll with Windows Hello. Before you do so, the account you’re using must have a password and a PIN, so you can still sign-in should anything go wrong. And in each case, there really isn’t much to say about the enrollment process, which is quick and easy. In fact, in Windows 10 Field Guide, which I’ll announce this coming week, Windows Hello warrants barely a paragraph since there’s so little to say about setting it up. You just set it up and it works.

But I know you’re curious. I wrote about Windows Hello’s fingerprint scanning capabilities in Hands-On with Windows Hello. Here, I’ll quickly show what it’s like to use facial scanning. That it’s not in any way dramatic is, perhaps, the salient point.

Once the camera is correctly setup—Windows will install the basic drivers automatically, but you need to be sure to install Intel’s separate Depth Camera Manager software too—you can simply navigate to Settings, Accounts, Sign-In options and see that a new option, Windows Hello, has appeared. And that, in this case, “Face”—or, facial recognition—is available.

So you click Set Up to step through a very short wizard.

After confirming your identity with your PIN, the RealSense camera will scan your face, and will tell you if it can’t see you correctly.

And that’s it: the wizard completes very quickly, though you are given the option to “improve recognition,” which is useful for people who sometimes wear glasses or if you just want to be sure that the system is precise.

As you can see, there are also two new options related to Windows Hello facial recognition:

Automatically unlock the screen if we recognize your face. This is enabled by default, and is of course the point of using Windows Hello.

For extra security, require turning your head left and right to unlock the screen. Disabled by default, you can enable this option to improve the security of the system. (I’d imagine the security impact is similar to that of going from a 4-digit PIN to a 6- or 8-digit PIN, but since the system doesn’t require you to perform further enrollment when this option is enabled, that is unclear.)

In use, Windows Hello is amazingly fast. So fast, in fact, that it’s difficult to take photos of it happening. Here, I had to position my face off camera so Windows Hello could confusingly “look around,” trying to see me.

In instances where you have purposefully locked the screen to go to lunch or whatever, but are still sitting in front of the PC, Windows Hello will not just stupidly re-sign you in repeatedly. Instead, it will detect that you have not moved and ask you to manually release the lock screen by pressing a key or swiping up the screen. Then, it will kick in and work normally.

Basically, Windows Hello—and in particular the facial scanning version—is the absolute simplest and fastest way to sign-in to Windows 10, and it makes even a PIN seem tedious by comparison. And because it works like a PIN, you can use it for other authentication needs in Windows, such as approving an app purchase. I can’t wait until this hardware is simply built into the PCs I use regularly.