Security with "Use the Trusted Platform Module with Windows Hello"

Thanks for the follow up, Former Member. @ForgottenPasswords, please let us know if you have any additional questions.

Thank you @ag_mike_d and Former Member for your responses.

I shall be using Windows Hello then. It makes using 1Password much more convenient.

Have a great week, and keep 1Password rocking.

Thanks, @ForgottenPasswords! 👍

Hi @ag_mike_d,

"Without the TPM option enabled, Windows Hello stays within our process so any phishing attempts by a malicious process wouldn’t work. However with Enhanced Windows Hello, a malicious process can potentially trick you into accepting a context-less prompt in order to decrypt your data. We've included the above prompt to have the user confirm that they know the risks and that you trust other apps on your system which generate their own Windows Hello prompts."

I'm new to 1Password and I have to admit that the prompt spooked me! I admit that having to re-enter my master password after reboots is helpful in that it has forced me into remembering my long, cryptic password, but it is equally a nuisance.

Honestly, I still don't fully understand the risk and, yes, I've ready the article. Just to be certain, is it that a malicious app can trigger a Windows Hello authentication pretending to be 1Password and, if I authenticate, I will grant that malicious app access to my 1Password sites and logons?

It's just that I'm not sure exactly what the risk level is because I just don't understand how the malware will behave. 1Password is the only app on my PC that integrates with Windows Hello; if, for example, I would see an unexpected 1Password authentication, then for sure that would alert me that it may be due to a malicious app, which is a risk with risk I can live.

Thanks!

Hello @Nusaram,

Thanks for your message.

1Password is the only app on my PC that integrates with Windows Hello; if, for example, I would see an unexpected 1Password authentication, then for sure that would alert me that it may be due to a malicious app, which is a risk with risk I can live.

I can't speak specifically to how malware may trigger a Windows Hello prompt. However, in this case, when using Enhanced Windows Hello, by opening 1Password - if it continues to be the only trusted software on your device using Windows Hello - you can be sure this prompt is coming from 1Password.

I hope this helps to relieve some concern, but please let us know if you have any other questions.

Hi @ag_mike_d,

Yes, it does! That was extremely helpful info.

Thank you!

You're most welcome, @Nusaram - Happy New Year!

Thank you, @ag_mike_d, and Happy 2023 to you, too!

So, I enabled the TPM option but it is not surviving the Windows reboot. :( It did once, but that's it; apart from that "rare" instance, I'm still being asked to enter my master password before using Windows Hello. The settings remain do remain enabled, however.

What's interesting, though, is that after I unlock with my master password, the Windows Hello dialog window to unlock appears, which is weird.

I'm on Windows 11 22H2 and am using a Surface Laptop Studio which, of course, has TPM 2.0.

I found this thread but I do not have fast startup enabled, nor were there any BIOS updates, etc.

Well, after continuing to search this forum, I found other posts about the same issue so, clearly, this is a known and ongoing issue.

What could be causing this?

@Nusaram I had a similar issue recently where I thought it wasn't working - are you getting a smiley facing showing next to the login field? If so click on it and this will manually trigger the Windows Hello process...

Hello again @Nusaram,

I'm sorry to hear of the troubles with Windows Hello not surviving a restart.

Can you please try the below list of steps after a reboot of your device:
1. Open 1Password and enter your account password.
1. When the Windows Hello prompt appears, enter your PIN, fingerprint, etc.
1. Completely exit 1Password by right-clicking the icon in the system tray and selecting Quit.
1. Try relaunching 1Password 8 for Windows.
1. If that works, try once again but this time reboot your PC and open 1Password.

If you still see issues after this reboot, could you try re-enrolling your Windows Hello data by removing and then re-adding all of your Windows Hello options, such as face, fingerprint and PIN? If the option to remove the PIN is greyed out, you may need to disable the option to only allow Windows Hello sign-in for Microsoft accounts on this device first.

Let us know how this goes. Thanks!