Security researchers at SSYS have found a Windows Hello facial authentication vulnerable to a "simple spoofing attack".