Security with "Use the Trusted Platform Module with Windows Hello"

You're most welcome, Nusaram - Happy New Year!

Hi ag_mike_d,

Yes, it does! That was extremely helpful info.

Thank you!

Hello Nusaram,

Thanks for your message.

1Password is the only app on my PC that integrates with Windows Hello; if, for example, I would see an unexpected 1Password authentication, then for sure that would alert me that it may be due to a malicious app, which is a risk with risk I can live.

I can't speak specifically to how malware may trigger a Windows Hello prompt. However, in this case, when using Enhanced Windows Hello, by opening 1Password - if it continues to be the only trusted software on your device using Windows Hello - you can be sure this prompt is coming from 1Password.

I hope this helps to relieve some concern, but please let us know if you have any other questions.

Hi ag_mike_d,

"Without the TPM option enabled, Windows Hello stays within our process so any phishing attempts by a malicious process wouldn’t work. However with Enhanced Windows Hello, a malicious process can potentially trick you into accepting a context-less prompt in order to decrypt your data. We've included the above prompt to have the user confirm that they know the risks and that you trust other apps on your system which generate their own Windows Hello prompts."

I'm new to 1Password and I have to admit that the prompt spooked me! I admit that having to re-enter my master password after reboots is helpful in that it has forced me into remembering my long, cryptic password, but it is equally a nuisance.

Honestly, I still don't fully understand the risk and, yes, I've ready the article. Just to be certain, is it that a malicious app can trigger a Windows Hello authentication pretending to be 1Password and, if I authenticate, I will grant that malicious app access to my 1Password sites and logons?

It's just that I'm not sure exactly what the risk level is because I just don't understand how the malware will behave. 1Password is the only app on my PC that integrates with Windows Hello; if, for example, I would see an unexpected 1Password authentication, then for sure that would alert me that it may be due to a malicious app, which is a risk with risk I can live.

Thanks!

Thanks, ForgottenPasswords! 👍

Thank you ag_mike_d and Former Member for your responses.

I shall be using Windows Hello then. It makes using 1Password much more convenient.

Have a great week, and keep 1Password rocking.

Thanks for the follow up, Former Member. ForgottenPasswords, please let us know if you have any additional questions.

If your computer doesn't have a TPM, Windows emulates some of its functionality in software. With a hardware TPM, things like the secret to unlock 1Password survives a reboot, so you can unlock 1Password after a reboot with just your Hello pin. With the software emulation, such stuff is kept in protected CPU memory only, so you need to enter your 1Password master password once to unlock after a reboot. Additional unlocks are with PIN, since the secret to unlock is kept in memory - until next reboot. What survives a reboot even with the software emulation is the ability to login to Windows itself.

Hello ForgottenPasswords,

Thanks for your reaching out with your question about Windows Hello and 1Password. I've included a link to a related articles about Windows Hello security in 1Password for Windows.

If you'd like to enable Windows Hello, you can follow this guide: Use Windows Hello to unlock 1Password on your Windows PC

We appreciate your kind words about 1Password! 💙

Hello!

I recently installed Windows 11 by using a method to bypass requirements for a supported CPU and a TPM module.

After installing 1Password on the new installation, I discovered that using Windows Hello PIN would be a really convenient method to unlock 1Password.

However, I have concerns about the security of this, since my computer doesn't have a TPM module at all (not even v1).

Am I still safe to use Windows Hello with 1Password? How is the security ensured in this case?

Thanks, I love 1Password very much.