Security Analysis and Bypass User Authentication Bound to Device of Windows Hello in the Wild

<div>Detailed protocol flow: application login with Windows Hello. The user and the device are authenticated to obtain the access token (<span class="nowrap"><svg height="12.1436pt" id="M22" style="vertical-align:-3.18148pt" version="1.1" viewbox="-0.0498162 -8.96212 12.249 12.1436" width="12.249pt" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><g transform="matrix(.013,0,0,-0.013,0,0)"><path d="M620 675H597C578 656 570 650 541 650H144C112 650 104 653 94 675H72C59 618 42 552 23 493L53 491C71 534 88 564 105 585C124 608 144 615 238 615H290L197 121C182 40 174 34 88 28L82 0H361L367 28C275 34 266 38 281 121L374 615H441C522 615 543 608 553 583C562 560 566 531 565 493L597 494C603 551 612 629 620 675Z"></path></g><g transform="matrix(.0091,0,0,-0.0091,7.176,3.132)"><path d="M462 177V227H365V632H320C217 496 116 350 21 208V177H284V109C284 43 280 38 190 31V0H451V31C369 38 365 43 365 108V177H462ZM284 227H88C155 336 218 430 282 519H284V227Z"></path></g></svg>)</span> for use by the service provider.</div>

Security and Communication Networks

fig5

Figure 5

Figure 5: Security Analysis and Bypass User Authentication Bound to Device of Windows Hello in the Wild 