Solved Your opinion on the 'Can of Worms' that is TPM

glasskuter said:

The data processed by the TPM is separate from the OS and contained within the TPM microprocessor ONLY. With a TPM problem, backups won't help you. If a pin fails, somehow the TPM communicates that to the windows logon process that makes it give the option of using a password. No, I am not smart enough to know exactly how it does this. But when multiple people across the web complain of TPM related problems and say that they are never offered to enter a password, I have no reason to doubt them all. Anyone who has worked with computers as long as I have knows that crap can happen and does happen to screw up the normal flow of events.

Click to expand...

That's not how it works. Let me explain...

Assuming you are using BitLocker: When you perform a backup, the data is decrypted on the fly so what you are actually backing up is a decrypted copy of all the data on the disk. It's exactly the same as it would be when you sit in front of the computer and access any file. say for example that you open a Word document. That document is decrypted from the disk on the fly so that you can access it. Same thing happens as you create your backup - the data is decrypted on the fly. This is why companies such as Macrium note this and recommend that you still employ encryption within their backup software.

If you are not using BitLocker: In that case, loss of the TPM doesn't matter. Your data is still safely backed up as usual and can be restored without your pin or password (the backup password would still be needed). Remember, if I have physical access to your machine, I can easily get at all your data, if you are not using disk encryption such as BitLocker, regardless of whether I have your password or pin. Your password or pin only secures access to your data if someone does not have physical access to your system.

EDIT: Just adding another example. Take a Windows disk and remove it from your computer. Plug it into another system. You can access all data easily. Doesn't matter whether or not you had a TPM unless you are using full disk encryption such as BitLocker. That is the very reason that full disk encryption exists.

When setting up a Pin number I always look at phone numbers here in the UK phone numbers are 11 digits, which gives Nine billion variations. ( and that assumes that someone trying to guess knows how many characters are needed so the real number is much larger )

I find that I can use the numeric keyboard to type an eleven digit number in a second or two which helps with those looking over shoulders

Of course don't pick a current or recent number that is tied to yourself, but we all have a number that sticks with you from our past life An old home phone number including the code or a parents number or a works number. This sort of thing will be remembered, so does not have to be recorded anywhere, except on the local PC (Windows Pin Numbers are stored and processed locally so are more secure than passwords which MAY be held online

Well I can honestly say the TMP has had no effect, I have just updated my BIOS and all went well, no problems at all. I use automatic logon with netplwiz I had to change from a pin to a password to do it. great, works a treat. If I change things or create a task etc. it asks for my password if I logout and back in, it asks for my pin which works fine as well

If you create a pin that is not just the minimum 4 digits but as you can, use a mixture of numbers and letters, that isn't IMO any quicker logging on than using a decent local password, both are stored locally and hashed.
I wouldn't use a phone number as such, even old numbers may still be linked to you somewhere online, I recently removed one from 10 years ago from a supplier, I hadn't used for a long time, might consider using one backwards though.

hsehestedt said:

That's not how it works. Let me explain...

Click to expand...

Respectfully, I say part of your statement is incorrect. You keep talking bitlocker. I am not talking about TPM's relationship with bitlocker. I am talking about TPM's relationship with Windows Hello. Bitlocker and Windows Hello is apples and oranges...2 separate functions of TPM. When a TPM is present, bitlocker uses it, but you can configure bitlocker through local group policy even if you do not have TPM. You cannot use Windows Hello without TPM.
Example: I have TPM 2.0. I do not use bitlocker. I do use Windows Hello. Windows Hello is a separate function from Bitlocker.

This Windows Hello authentication key is stored strictly within the TPM chip, NOT on the hard drive. A backup does not backup the information on the TPM chip.

When the PIN is created, it establishes a trusted relationship with the identity provider and creates an asymmetric key pair that is used for authentication. When you enter your PIN, it unlocks the authentication key within the TPM and it is that key to sign the request that is sent to the authenticating server. If for whatever reason this authentication key within the TPM gets corrupted, a Pin would not work, and the user is given the option to use a password. This is the part of the process that has failed for some people. Just because it has NOT YET happened for you or me does not mean that it can't happen.

Don't believe me about how it works. Read the Microsoft document.

That's the basis of my argument that taking WIndows Hello out of the equation is one thing a user can do to possibly make life easier on down the road. I am content to agree to disagree because we all have our own understanding of all the smoke and mirrors that is Windows.

glasskuter said:

Respectfully, I say part of your statement is incorrect.

Click to expand...

You may notice that I reference both with and without BitLocker. I was differentiating between the two. My point is that if you have a backup you can recover from anything - even if Windows Hello and your password fail. There is no circumstance whatsoever that you cannot recover from if you have a <good> backup.

On my sign-in screen, if I select Sign in Options two icons appear. The left icon, a keypad, when I hover my mouse over it the pop out says PIN. The right icon for computer login the pop out says Microsoft Account Password. I know some people don't have a MS account password for whatever reason. In those cases if their PIN fails, they may or not be prompted for a password. Without a MS account password, they could be locked out. At least that's the way I see it, just thinking out loud here.

When I made my PIN I made a complex one with upper/lower case, numbers, and special characters. I do like how it's tied to the physical machine.

For those curious about why TPM and its intent, this Jan 1, 2000, Microsoft article may shed some light: Trusted Platform Module (TPM). Simple, clear, concise.

hsehestedt said:

A pin actually works very differently. See this information from Microsoft for a detailed explanation:

Windows Hello for Business overview

Learn how Windows Hello for Business replaces passwords with strong two-factor authentication on Windows devices.

docs.microsoft.com

Click to expand...

I think what @geneo is saying is that if for some reason the pin doesn't work you can still use your password.

Winuser said:

I think what @geneo is saying is that if for some reason the pin doesn't work you can still use your password.

Click to expand...

and a bit more.

Scott said:

On my sign-in screen, if I select Sign in Options two icons appear. The left icon, a keypad, when I hover my mouse over it the pop out says PIN. The right icon for computer login the pop out says Microsoft Account Password. I know some people don't have a MS account password for whatever reason. In those cases if their PIN fails, they may or not be prompted for a password. Without a MS account password, they could be locked out. At least that's the way I see it, just thinking out loud here.

When I made my PIN I made a complex one with upper/lower case, numbers, and special characters. I do like how it's tied to the physical machine.

Click to expand...

How does one create a pin without using their MS account password? As far as I know using a pin is part of the Windows Hello.

Winuser said:

How does one create a pin without using their MS account password? As far as I know using a pin is part of the Windows Hello.

Click to expand...

You should be able to use it with some other password protected online accounts.

I just noticed a setting in Accounts > Sign-in options. Under Additional setting is an option to only allow Windows Hello sign-in for Microsoft accounts on this device. I wonder having this option turned on is why some users don't have the option to use their password instead of the pin?

Winuser said:

I just noticed a setting in Accounts > Sign-in options. Under Additional setting is an option to only allow Windows Hello sign-in for Microsoft accounts on this device. I wonder having this option turned on is why some users don't have the option to use their password instead of the pin?

Click to expand...

Wasn't the case for Dru2.

I gotta say all of this is hokus pokus, make you feel better, we got your back in an insecure scary world marketing. It isn't any great advance in security from what I can tell. Sure when you use a password with a network account you have to send the encrypted password over the network as opposed to a local PIN. But that can't be a big deal. And that password is stored somewhere in the cloud. After all, you used to be able to be able to password protect locally, but then there had to be a backdoor in-case you forgot. IDK, maybe I am missing something but I don't think so.

Winuser said:

I think what @geneo is saying is that if for some reason the pin doesn't work you can still use your password

Click to expand...

That statement is absolutely correct if everything is working correctly. BUT according to posts I have read from users across the web it doesn't always happen the way it is supposed to. They never see an option to enter a password. Whether it is an issue with Windows or from whatever reason the TPM gets hosed up (bios update, whatever), the flow of the login process is affected. If the issue in on the Windows side, maybe our backups would save us. But if the issue is on the TPM side, backups are useless.

There are enough instances reported that this should be a concern for everyone. If it works as expected ALL the time, I wouldn't be concerned. But it's a computer and as we say here in Texas, things don't always run according to Hoyle.

Don't use a PIN or don't do a BIOS update until it is straightened out?

And report any issues to the feedback hub. It may not directly be a Microsoft issue, but Windows should not lock you out - it should give you the option to use a password.

geneo said:

until it is straightened out

Click to expand...

Straightened out by whom exactly. Microsoft? The manufacturers who release new bios? You can no longer get MS on the phone. It's been reported in feedback hub which I highly doubt they pay much attention to now that the OS is released. The thing is it's not one particular OEM bios nor does it happen to everyone who updates their bios. It's a very sporadic issue that even experienced users can't make heads or tails of.
It hasn't happened to me...YET... And I don't want it to. It just makes sense to me to be pro-active and take the TPM out of the login picture. I'll first turn off pin and use my MS account to login. Then I'll try to figure out a way to permanently stop the "set up a pin' nag. It comes back even after disabling it in Group Policy. If I can't get rid of it permanently, I'll use a local account.

I do agree with @geneo. It's hokus pokus, make you feel better, we got your back in an insecure scary world marketing

I appreciate all the feedback you guys have given on this thread.

glasskuter said:

That statement is absolutely correct if everything is working correctly. BUT according to posts I have read from users across the web it doesn't always happen the way it is supposed to. They never see an option to enter a password. Whether it is an issue with Windows or from whatever reason the TPM gets hosed up (bios update, whatever), the flow of the login process is affected. If the issue in on the Windows side, maybe our backups would save us. But if the issue is on the TPM side, backups are useless.

There are enough instances reported that this should be a concern for everyone. If it works as expected ALL the time, I wouldn't be concerned. But it's a computer and as we say here in Texas, things don't always run according to Hoyle.

Click to expand...

I've only device I had trouble using my pin was on my Acer Spin Laptop. Sometimes I would get a pin not recognized error. I always had the option to use my MS account password.

geneo said:

Don't use a PIN or don't do a BIOS update until it is straightened out?

And report any issues to the feedback hub. It may not directly be a Microsoft issue, but Windows should not lock you out - it should give you the option to use a password.

Click to expand...

I found a setting in Accounts > Sign-in options to only use Windows Hello to sign-in for Microsoft Accounts on this device. I don't know if turning this option on prevents someone to using their password when logging in or not.

Not sure what the issue would be if the drives not encrypted and you can boot to the password screen, so can go to the Recovery Environment/ Boot selection menus and also use safemode to access anything on the drive if you have no Emergency boot USB drive. So not data loss from that point, although a robust backup procedure (as stated earlier) is always best practice to do.

The TPM is a great way to prove that the Originating request is real and from who you think it should be from, Android/Apple phones have had security processors for years to handle secure banking apps etc, all based off PIN or biometrics with an account password backup.

If your not using it to encrypt drives (save your keys if you are), and running good backups, its like worrying about going out in your car and getting a flat, it might happen but its easily fixed and the contents of the car are still there, won't stop you using your car though.