It works using biometrics. Biometrics isn't new - thumbprint scanners and camera based authentication have been around for a while. But they've had some problems. Camera based authentication was difficult to do. Lighting problems, angle of the camera, etc., performance of the PC all contribute to reliability issues. In addition, these could sometimes be fooled using just a picture of your face. Similar problems with fingerprint scanners have kept them from being as successful in real life as the are in the movies...
So, what's different?
Well, first, the technology is built in to Windows 10. In older fingerprint scanners, for instance, the manufacturer of the sensor created the software that reads the sensor and integrates with the operating system. Now, this functionality is built in to Windows 10. While new pressure sensitive fingerprint readers will be coming on newer laptops, this technology will also work with older fingerprint readers as well.
In the case of face recognition biometrics, the situation is a little more complex. The camera technology used in Windows 10 face recognition requires a new camera based on the Intel RealSense technology. Your laptop doesn't have one of these. So, for now at least, you'd need a clunky external camera to make this work. You also need a processor in your PC that has a 4th generation or later Haswell processor. So, I don't think people will be using this much until these cameras start making their way to new laptops, sometime later this year.
The security of the new biometrics system is where it really shines. The newer sensors can check for temperature and even pulse before authenticating a fingerprint. It also uses a 3D scan of your fingerprint rather than a flat "picture". The characteristics of the fingerprint are stored on the PC - no picture of your fingerprint is stored, and the characteristics are never sent off your PC.
Same with facial features. It looks at characteristics of your face in 3D and compares them to what is stored rather than trying to match a picture. The new RealSense camera is both 3D and infrared so it can tell if it's looking at a real person versus a picture. As a backup, you can use a PIN to authenticate - just in case the fingerprint or facial recognition software doesn't work after 5 attempts.
If your face changes - you grow a beard or start wearing glasses - you need to re-train your computer, but it only takes a minute or two.
I'll be exploring these options as the technology becomes available and I'll blog about them here once I've had a chance to play with them.