4 ms·

What's the difference between the two? I can log into my laptop with a password or a PIN; I assume anyone that steals or hacks my laptop can _also_ log in with

What's the difference between the two? I can log into my laptop with a password or a PIN; I assume anyone that steals or hacks my laptop can _also_ log in with a password or a PIN. PINs are inherently shorter and more simpler than passwords; why would anyone use a PIN over a password?

toast0 2y ago
If you change your motherboard, your windows PIN won't work anymore, and you'll have to login to the underlying microsoft online account. A regular local account with a password would still work after a motherboard change. This is assuming no bitlocker. If you have bitlocker, I don't know if bitlocker key recovery will also fix the pin (hopefully you printed the recovery key and can find it) I'm guessing this would also mess up passkeys.
- UltraSane 2y ago
  AMD CPUs have fTPM built in so the passkeys are actually stored in the CPU. This is more secure because separate TPM chips on the mobo have been attacked by listening to the traces from the TPM to the CPU.
  - toast0 2y ago
    Maybe the PIN doesn't change if you swap the motherboard and keep the CPU, maybe. But if you swap the motherboard and the CPU your PIN doesn't work anymore.
hahn-kev 2y ago
The difference is that I can't login to your account using a pin. I need to use your master password or passkey, then once I have I can use a pin. Basically the pin is only local to your machine, so yes if someone steals your laptop it's the same, but there's a lot less people than can steal your laptop then can try to guess your Gmail password
vel0city 2y ago
The PIN on a Windows machine is a secondary credential to unlock the primary local credential, with the primary being your actual password. Also, as mentioned in the sibling comment, PINs are just device-local credentials. They don't necessarily have to be numeric-only and can also be very long. You can have your computer re-challenge you for a full password on some interval. So have it force you to use your password on your first login of the day, then you can use your PIN to hop back in during the day and then have the PIN option time out after so many hours. Same with any of the Hello credential options. After too many failures with a PIN, it will disallow the PIN authentication entirely. So, its length isn't really a problem, it'll start to disallow PIN attempts after only a few wrong guesses. Once again, also configurable. Meanwhile, it'll always still allow a password although it'll start trying to slow you down on password attempts. PINs are supposed to be stored on the TPM or similar secure platform module, they're not stored on the local computer storage. So, there's not some easily accessible file to do brute-forcing outside of the computer. While consumer Windows isn't really Windows Hello for Business, the same basic ideas of PIN security are the same. Here's the FAQs on that which also go into some depth of why PINs over passwords: https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/faq https://learn.microsoft.com/en-us/windows/security/identity-...
- reginald78 2y ago
  I don't understand the purpose of this at all then. That sounds like I now need to remember two passwords, one with all the problems passwords always had and a second one that requires my device to be useful. I hardly think two different attack vectors is better than one attack vector security wise, especially if one of the two former vectors is also the single later. I guess the idea is that it is easier to use. I just setup a PIN for Windows Hello. The PIN requirements were more strict than the password requirements, so that is hardly more convenient. Maybe this is punishment for not wanting to use a fingerprint or face scan which remain optional. For now anyway, it feels like all I did was get my goose half cooked and end up with two passwords whereas before I had one. Even if I did give my face scan or whatever, I still need to use my password to login to things so my original point about two attack vectors seems to still stand.

toast0 2y ago

If you change your motherboard, your windows PIN won't work anymore, and you'll have to login to the underlying microsoft online account. A regular local account with a password would still work after a motherboard change. This is assuming no bitlocker. If you have bitlocker, I don't know if bitlocker key recovery will also fix the pin (hopefully you printed the recovery key and can find it) I'm guessing this would also mess up passkeys.

UltraSane 2y ago
AMD CPUs have fTPM built in so the passkeys are actually stored in the CPU. This is more secure because separate TPM chips on the mobo have been attacked by listening to the traces from the TPM to the CPU.
- toast0 2y ago
  Maybe the PIN doesn't change if you swap the motherboard and keep the CPU, maybe. But if you swap the motherboard and the CPU your PIN doesn't work anymore.

hahn-kev 2y ago

The difference is that I can't login to your account using a pin. I need to use your master password or passkey, then once I have I can use a pin. Basically the pin is only local to your machine, so yes if someone steals your laptop it's the same, but there's a lot less people than can steal your laptop then can try to guess your Gmail password

vel0city 2y ago

The PIN on a Windows machine is a secondary credential to unlock the primary local credential, with the primary being your actual password. Also, as mentioned in the sibling comment, PINs are just device-local credentials. They don't necessarily have to be numeric-only and can also be very long. You can have your computer re-challenge you for a full password on some interval. So have it force you to use your password on your first login of the day, then you can use your PIN to hop back in during the day and then have the PIN option time out after so many hours. Same with any of the Hello credential options. After too many failures with a PIN, it will disallow the PIN authentication entirely. So, its length isn't really a problem, it'll start to disallow PIN attempts after only a few wrong guesses. Once again, also configurable. Meanwhile, it'll always still allow a password although it'll start trying to slow you down on password attempts. PINs are supposed to be stored on the TPM or similar secure platform module, they're not stored on the local computer storage. So, there's not some easily accessible file to do brute-forcing outside of the computer. While consumer Windows isn't really Windows Hello for Business, the same basic ideas of PIN security are the same. Here's the FAQs on that which also go into some depth of why PINs over passwords: https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/faq https://learn.microsoft.com/en-us/windows/security/identity-...

reginald78 2y ago
I don't understand the purpose of this at all then. That sounds like I now need to remember two passwords, one with all the problems passwords always had and a second one that requires my device to be useful. I hardly think two different attack vectors is better than one attack vector security wise, especially if one of the two former vectors is also the single later. I guess the idea is that it is easier to use. I just setup a PIN for Windows Hello. The PIN requirements were more strict than the password requirements, so that is hardly more convenient. Maybe this is punishment for not wanting to use a fingerprint or face scan which remain optional. For now anyway, it feels like all I did was get my goose half cooked and end up with two passwords whereas before I had one. Even if I did give my face scan or whatever, I still need to use my password to login to things so my original point about two attack vectors seems to still stand.