3 ms·
If pin is implemented correctly, then it is almost as secure. That is, the user has a very limited number of tries after which, only the password will unlock i
by jjeaff 7y ago
If pin is implemented correctly, then it is almost as secure.
That is, the user has a very limited number of tries after which, only the password will unlock it.
Then of course, great care must be taken to disallow resetting those number of tries.
- WorldMaker 7y agoMost importantly, the PIN is used to unlock a private key in the hardware TPM module: it's the private key that is the real password for the account at that point. The PIN is never sent over the wire anywhere (no server knows it, it isn't even on the local hard-drive, it's just a TPM unlock code), it simply unlocks that key and it is that device key that is then used to unlock everything else. (Same for Windows Hello whether faceprint or thumbprint or what have you: the biometrics just unlock the local TPM key, they are never shared outside of that device and its relationship with the local TPM.)