Most people will surely agree that passwords are terrible security mechanisms for our digital lives, given how easy they are to forget and how vulnerable they are to being stolen, hacked or otherwise compromised.

And since compromised passwords can be used from anywhere, on any machine to get at your stuff, replacing passwords with biometric information like faces and fingerprints has long been an alternative method for protecting your important data.

Unfortunately biometric identifiers have had their share of problems as well, not least of which was the required hardware being a bit on the expensive side, and insufficiently advanced to be foolproof.

But now Microsoft believes it has a solution that addresses all of the security concerns inherent to biometric identification, and it’s called Windows Hello, one of the core features of Microsoft’s latest operating system, Windows 10.

When set up correctly, Windows Hello lets you log into Windows and various online services using nothing more than your face or finger, and takes less than a second. But more importantly, it’s been designed in such a way that authenticating with your physical self is far more secure than ever before.

That’s because it works in tandem with another feature called Windows Passport, which helps to verify your identity in a super secure way that hackers can’t easily reproduce. The combination of Windows Hello and Windows Passport is so secure, Microsoft goes so far as to say it’s impossible to reverse-engineer.

How can that be, you ask? Well, Windows Hello uses advanced facial recognition techniques that can’t be fooled by anything that isn’t you. The only potential snag is that this requires modern camera hardware, as it makes use of the infrared light spectrum which the vast majority of webcams out there right now don’t support.

That may limit Hello’s usefulness and relevance initially, but as new laptops hit the market that have the necessary hardware and Hello-supported webcams hit the shops for people who don’t want or need to upgrade their existing computers, it should take off quite nicely.

Interestingly, not even the Kinect 2.0 sensor is advanced enough for use with Windows Hello, a surprise as that sensor was touted by Microsoft to be pretty advanced back when it debuted alongside the Xbox One in 2013.

How it works

Basically, here’s how it works: authenticating with Windows Hello is a two-part process: the first part “sees” your face, reads your fingerprint or verifies your PIN (or all three, if you like).

Once those biometrics have been recorded, that information is encrypted and stored locally on your PC as a “private key”, and it is never, ever transmitted over the internet. That means there’s no information being transmitted for dodgy organisations like the US’s NSA to intercept, and as all local data relating to that key is encrypted, it’s locked up tight.

The second part of the process involves your Microsoft Account (your Passport), which is the credential that identifies you as a Windows user, and determines what online resources you have access to.

This is the “public key” part of the equation, and to successfully verify your identity, both public and private keys need to authenticate against one another, meaning attackers will need both to compromise your data. That means your identity can’t be stolen and used for nefarious purposes without you being physically present at the hacker’s real-world location, and that’s not likely to happen.

When you attempt to access something like a website that requires identification, your PC authenticates you with your face, fingerprint or PIN number, and Passport authenticates you to that site/service so you don’t have to put in a password.

And because the only thing a hacker could ever potentially steal is your public key, and because the private key is both encrypted and saved to your local machine, it’s not going to be very useful to them and you are therefore safer than you would be using just a password.

So when big hacks happen, and hackers get hold of huge databases of usernames and passwords, if you’re a Windows Hello user, you’ll have nothing to worry about.