3 ms·
> It's not compromised if you set a PIN/passkey, aka use it correctly. The issue is that you have to go out of your way to set it up this way. Last I checked,
by vladvasiliu 3y ago
> It's not compromised if you set a PIN/passkey, aka use it correctly.
The issue is that you have to go out of your way to set it up this way. Last I checked, you couldn't just add a PIN. You had to enable it through GPO.
- GordonS 3y agoIIRC you can set a PIN without fiddling with security settings or GPOs, but if you want to use a password instead of a PIN, then you've got to jump through some hoops to enable that. It always struck me as a very, very strange design choice - why make it so difficult?!
- vladvasiliu 3y agoJust checked on my up-to-date win 11 22h2 pro. I can't set a pin by default. > Computer Config / Admin templates / Win components / Bitlocker / Os Drive / Require additional authentication at startup > If you disable or do not configure this policy setting, users can configure only basic options on computers with a TPM. This enables tpm + pin and / or password unlock. But only numeric pins. If you want alphanumeric, or "enhanced", pins, you have to enable a separate GPO in the same place: allow enhanced pins for startup. > If you disable or do not configure this policy setting, enhanced PINs will not be used.
- FirmwareBurner 3y agoIt's on for corporate users, but I assume because it would be a terrible UX for consumers, having users always enter a PIN code at boot/re-boot and would make them throw their PCs out the window. It's even worse if you use a Bluetooth keyboard as that doesn't work at BIOS level so you'd have to plug in an USB keyboard just to enter your PIN on boot. Would be maddening and people would just turn it off.