Solved Your opinion on the 'Can of Worms' that is TPM

glasskuter · Dec 15, 2021

With Windows 10 and now Windows 11, on this forum and across the web, there are reports of problems relating to logging in using a pin. This has me thinking about what misery this can of worms will give users going forward.

Folks find themselves locked out because they forget their pin or entered their correct pin but didn’t notice the CAPS lock was on and tried too many times. Right here on this form, a user was locked out of his computer due to a simple bios update. I even read reports where a user could not login after a power surge. Usually when such instances happen, if things are working like they’re supposed to, we have an option to set up another pin, but we all know things don’t always happen as they’re supposed to. Weird stuff happens.

When you couple in a user’s lack of understanding surrounding TPM/Windows Hello (and I’m one of them), it's my thinking that the future is going to cause trouble for a lot of people. Personally I love the convenience of using a 4 digit pin instead of a 12 digit complex password, but not at the expense of possibly losing access to Windows at some point due to some fluky occurrence.

So, my question to you is “As a CYA measure, doesn’t it make sense to disable Windows Hello and rely solely on a password?”

cereberus · Dec 15, 2021

or just make regular image backup in case something glitches?

Anibor_11 · Dec 15, 2021

If the problem arises because the TPM was cleared, it can´be solved with an image backup, as the TPM is not in any disk.

FrancoDT · Dec 15, 2021

I remember having that nightmare a few years back on my girlfriends old Win 10 PC. I booted it into safe mode to troubleshoot something and safe mode required the full password vs pin. Of course she couldn't remember the password and I couldn't get it back out of safe mode to use the pin so we were locked out. Ended up buying a little program called PCUnlocker and running it from a USB stick to unlock her PC. When I reset the password I left it empty since it gave me the option so from then on it booted without any password needed. That was a $30 mistake and lession learned not to forget your PC password lol.

PerpetualCycle · Dec 15, 2021

What is the difference? Isn't your password a backup to your PIN? You have to have a password to have a PIN. In either case you have to rely on a password and remember it. or am I missing something?

glasskuter · Dec 15, 2021

cereberus said:
make regular image backup in case something glitches?

Image backup won't help you with any issue relating to TPM

BunnyJ · Dec 15, 2021

glasskuter said:
Image backup won't help you with any issue relating to TPM

It will if you have to reinstall Windows

ThrashZone · Dec 15, 2021

Hi,
Selling processors just got more complicated lol

hsehestedt · Dec 15, 2021

geneo said:
What is the difference? Isn't your password a backup to your PIN? You have to have a password to have a PIN. In either case you have to rely on a password and remember it. or am I missing something?

A pin actually works very differently. See this information from Microsoft for a detailed explanation:

Windows Hello for Business overview

Learn how Windows Hello for Business replaces passwords with strong two-factor authentication on Windows devices.

docs.microsoft.com

glasskuter · Dec 15, 2021

BunnyJ said:
It will if you have to reinstall Windows

I'm not talking about normal circumstances here. I'm talking about some of the weird instances that folks have gotten into where their TPM microprocessor has been affected either by getting its brain scrambled for some reason or affected by a bios update (Which shouldn't happen but has for some people.) Restoring from a backup just puts the user right back where they were when it comes to logging in with a pin. In those specific cases, a backup is not worth diddly squat. If a pin is not used in the first place, then the TPM asymmetric key pair is not part of the equation.

ThrashZone · Dec 15, 2021

Hi,
Four number of your phone number can't forget that but your phone number isn't a secrete otherwise we'd never get text or phone spam lol

glasskuter · Dec 15, 2021

Even some of you who are way more experienced than me don't understand just how the TPM comes into play either. Read Brink's explanation of pin/Windows Hello and TPM carefully. It's repeated at the beginning of each of his tutorials regarding pins. Pay special attention to how the pin creates an asymmetric key pair with the TPM. EXAMPLE HERE It is for this reason that we are seeing weird, off the wall things happening with pins and why I feel using a pin may be asking for trouble at some point. Yeah, if things work as they should we can use our password to login. But for some users, things are NOT always happening as they should.

cereberus · Dec 15, 2021

Anibor_11 said:
If the problem arises because the TPM was cleared, it can´be solved with an image backup, as the TPM is not in any disk.

But surely that is not a Windows 11 issue - same would arise with Windows 10 if you set TPM up?

PerpetualCycle · Dec 15, 2021

hsehestedt said:
A pin actually works very differently. See this information from Microsoft for a detailed explanation:

Windows Hello for Business overview

Learn how Windows Hello for Business replaces passwords with strong two-factor authentication on Windows devices.

docs.microsoft.com

I think you misunderstood what I meant. I believe a login PIN has to be backed up by a account password? If you can't login with a PIN because your forgot it, you are supposed to be able to use the account and password. . Thus "password only" has know advantage in principle over a PIN+password fallback. The only difference between using the PIN and a password (as a fallback) I see, is logging in with the password isn't local while the PIN is local in the TPM.

Having said that, this sound like it could be a secure boot attestation issue. Did the OP try disabling secure boot in BIOS temporarily and logging in? To do so you usually have to set the OS in secure boot menu to "other" instead of Windows in the BIOS.

BTW - that can be a difference between WIndows 10 and 11. Securee boot is most certainly enabled in 11, not necessarily in 10.

glasskuter · Dec 15, 2021

Y'all are all missing the point of why I started the thread. This is not about a specific case of one computer or even what has caused various computers to have problems with pins in the first place. It's about knowing when the TPM is involved in the login process and something has affected the operation of that TPM, not everyone has been given the alternative option of using a password as we expect to happen. Knowing this can and has happened, what is your opinion of taking the TPM completely out of the login picture by disabling Windows Hello. Do you not think doing so just makes good computer sense?

glasskuter · Dec 15, 2021

cereberus said:
ame would arise with Windows 10

It has happened in 10. It's not an OS issue but a TPM issue.

hsehestedt · Dec 15, 2021

glasskuter said:
Y'all are all missing the point of why I started the thread. This is not about a specific case of one computer or even what has caused various computers to have problems with pins in the first place. It's about knowing when the TPM is involved in the login process and something has affected the operation of that TPM, not everyone has been given the alternative option of using a password as we expect to happen. Knowing this can and has happened, what is your opinion of taking the TPM completely out of the login picture by disabling Windows Hello. Do you not think doing so just makes good computer sense?

I'm having some problems with the scenario posed. I'm dubious about the assertion that the user would not be asked for a password if the TPM failed. I flat out don't believe these claims. But even if true, you should have backups to fall back on.

To test, I simply unplugged my TPM from my system. I should note that I use my TPM for more than some people as I also have my OS drive encrypted with BitLocker. I have to supply the recovery key for my OS drive. Windows hello facial recognition and the pin did not work, but I was able to supply my password. Even if my password also failed, I would have my backups. In the end, no matter what the failure, you should have backups. Call me cold hearted but I have less than zero sympathy for people who are too lazy to create <and test> a real backup scheme. If you don't have a reliable and fully tested backup scheme, then your data was not important to you. Period.

PerpetualCycle · Dec 15, 2021

hsehestedt said:
I'm having some problems with the scenario posed. I'm dubious about the assertion that the user would not be asked for a password if the TPM failed. I flat out don't believe these claims. But even if true, you should have backups to fall back on.

To test, I simply unplugged my TPM from my system. I should note that I use my TPM for more than some people as I also have my OS drive encrypted with BitLocker. I have to supply the recovery key for my OS drive. Windows hello facial recognition and the pin did not work, but I was able to supply my password. Even if my password also failed, I would have my backups. In the end, no matter what the failure, you should have backups. Call me cold hearted but I have less than zero sympathy for people who are too lazy to create <and test> a real backup scheme. If you don't have a reliable and fully tested backup scheme, then your data was not important to you. Period.

Software often has bugs.

glasskuter · Dec 15, 2021

hsehestedt said:
dubious about the assertion that the user would not be asked for a password if the TPM failed. I flat out don't believe these claims. But even if true, you should have backups to fall back on

The data processed by the TPM is separate from the OS and contained within the TPM microprocessor ONLY. With a TPM problem, backups won't help you. If a pin fails, somehow the TPM communicates that to the windows logon process that makes it give the option of using a password. No, I am not smart enough to know exactly how it does this. But when multiple people across the web complain of TPM related problems and say that they are never offered to enter a password, I have no reason to doubt them all. Anyone who has worked with computers as long as I have knows that crap can happen and does happen to screw up the normal flow of events.

glasskuter · Dec 15, 2021

Thanks to everyone who commented. We may not all have the same ideas, and we may not all agree on solutions to problems, but we're all here for the common good. That's a pretty neat thing.