Windows: Unlocking with facial recognition no longer in the dark

Anyone who uses facial recognition to unlock their device has probably stumbled across the fact that it no longer works in dark environments in recent weeks. The cause is a security update from the April Patchday, as some media reports now suggest.

However, Microsoft does not explicitly state this; the indications can only be linked to the fact through interpretation. A change to Windows Hello can be found in the Windows update notes from April: “After installing this or a later Windows update, Windows Hello face recognition requires color cameras to detect a visible face for login for improved security,” Microsoft wrote there.

Windows Hello change: reference to security update

Instead, the company refers to a vulnerability that was closed with the April Patchday updates. The error description is somewhat clumsy: “An automatic detection mechanism with insufficient detection or processing of malicious input interference in Windows Hello allows unauthorized attackers to perform local spoofing” (CVE-2025-26644 / EUVD-2025-10237, CVSS 5.1, risk “medium”). Microsoft does not explain exactly how attackers can impersonate someone else without authorization. According to Microsoft's list, all Windows versions from Windows 10 to Windows Server 2025 are affected.

Even children are familiar with the saying “All cats are grey at night”, which actually describes the inadequacies of the human visual system – only the rods in the retina are sensitive enough to see something even in low light, and they react to brightness, not colors. The same effect also applies to cameras; if the light is too low, they also only return grayscale. The infrared camera that is used next to the color camera of a device also returns no color images. Of course, this does not meet the new requirement of Windows Hello face recognition for a color image.

Since April, many people who use facial recognition to log on to their computer have therefore noticed that it no longer works when it is too dark. Shining a flashlight on your face with your cell phone helps, or you can use PIN entry or a fingerprint sensor. At least the reason for this is now clear: it is not due to degraded computer hardware, but is intentional on Microsoft's part. As a countermeasure, it is described online that deactivating the device camera in the device manager also enables recognition in the dark again – usually a webcam and an infrared camera are used. However, the camera is then not available for apps such as Teams, and it is unclear how long Microsoft will leave this loophole open.

(dmk)