> You can combine it all in a chip like the Apple T2 and then you would have to somehow probe the silicon For the T2, at least macOS uses a key derived from us

> You can combine it all in a chip like the Apple T2 and then you would have to somehow probe the silicon For the T2, at least macOS uses a key derived from useryou need both chip control _and_ user password to get in) Windows does not, relying instead on TPM only in a default BitLocker configuration. (with a PIN option via Group Policy, not part of the regular flow) As of why that's bad: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38632 https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...