Exactly and to elaborate, it means that the only secret a user needs to remember is a short PIN for OS-level authentication. The TPM's protection against modifi

Exactly and to elaborate, it means that the only secret a user needs to remember is a short PIN for OS-level authentication. The TPM's protection against modified boot and OS components make a brute force very difficult. Further, Windows will actually feed that PIN to the TPM for purposes of OS-level authentication, which leverages the TPM's enforcement of rate limits and lockouts in addition to OS-level implementations of those protections. A nice improvement would be to use a PIN entered at boot for purposes of drive decryption and then automatically pass it through to the OS-level login.