With Windows 11 there will be even more Windows machines with TPM on by default. Thanks to the TPM other password managers allow you to use Windows Hello even after restarting the app or the machine itself. Would this be possible for 1Password as well? It would be very similar to how the mobile apps work, there I also don't need my masterpassword after a restart and can use Face ID right away. Thanks to the TPM it should be as safe as with the mobile platforms where you allow this feature. 1Password Version: 8.1.2-22.NIGHTLY Extension Version: 2.0.5 OS Version: Windows 10 Sync Type: Not Provided

Hey there the_john19! That's a great question! Currently we aren't able to support Hello after reboot because there's no secure manner to store encryption keys on the device and store them securely through a reboot of the device. While I can't speak to future plans for 1Password, having a way to securely store these keys on the system persistently through a reboot is a requirement for providing this feature, and our Development team is always on the lookout for secure means to make this happen. We're all excited to see what we can build with 1Password and Windows 11. :smile: ref: /dev/core/core/8769

Dayton_ag Thanks for your reply, but that’s exactly what the TPM is for. It’s basically what the security chip on an iPhone or Android does, it provides a secure way to store the encryption keys on the device. Other password managers just check if a devices got one and if so, provides this feature. There are also plenty of well documented APIs by Microsoft to implement this in a very secure manner :) With Windows 11 basically all devices need a TPM chip (if they don’t change their mind), so with Win 11 this feature will be used by much more people with different password managers and so it would probably become a feature they expect 1Password to provide as well.

Thanks for your reply, but that’s exactly what the TPM is for. It’s basically what the security chip on an iPhone or Android does, it provides a secure way to store the encryption keys on the device. Understood! We are quite interested in TPM, and especially in what the combination of Windows 11 and TPM could bring. As Dayton_ag mentioned, we're not in a position to speak to what will be included in future versions of 1Password, but I can say that all of us want to provide something that's convenient, useful to lots of people, and really, really secure. TPM is certainly on our radar, for the reasons you've mentioned. But, "always in motion is the future," to quote a famous philosopher. 😀

Windows Hello basically provides this functionality, but it's important to note that you probably don't want to store raw keys in the TPM without either using a PIN, or using Windows Hello's biometric unlock of the NGC Container that underpins it.

Thanks for your feedback! :smile:

TPM For Windows Hello After Restart

39 Replies

AliH1P
1Password Team
4 years ago
Hey jpalo and Former Member, thanks for sharing your observations. At the moment, this is the expected behavior as the TPM state becomes invalidated as an extra security measure after a Windows and/or driver update.

I'm glad to hear it's otherwise working well for you!

Ali
Former Member
4 years ago
From what I observed in the last months, the TPM saved password was always forgotten after a system reboot that was required by Windows Update. It was not (as far as I remember never) forgotten after manual shutdown/reboot/restart initiated by myself.
jpalo
Occasional Contributor
4 years ago
FYI: This has worked well in the last 1-2 months, so thank you for the fix. Something I've noticed, though, is that whenever Windows 11 build is updated (Windows Insiders build), 1Password forgets the Hello configuration, and you need to type in your password to unlock one time, followed by the Hello authentication. After that it works correctly until a new Windows build is installed. Not sure if this is something that could even be handled by 1Password - in any case it may not be a high prio issue, however, it might also affect users installing larger Windows updates that occur 1-2 times per year.
MikeT
1Password Team
4 years ago
Thank you, I'll reply there.
gussic
Super Contributor
4 years ago
Hi MikeT

I have an existing ticket open #ALL-72966-442 - I have sent through another batch of diagnostics now but I have sent them previously as well - hopefully it helps you work out what is happening!
MikeT
1Password Team
4 years ago
Hi gussic,

Interesting. Could you send us your 1Password diagnostics report, it might explain what's going on.

Here's how to generate the report on Windows

Please email the report to support+forum@1password.com and in your email, also include:

A link to this thread: https://1password.community/discussion/122057/tpm-for-windows-hello-after-restart/p2

your forum username: gussic

Let us know here when you sent it, so we can look for it.
gussic
Super Contributor
4 years ago
Hey MikeT

This is the output I got:

```
PS C:\Users\user> certutil -csp "Microsoft Passport Key Storage Provider" -key -v | Select-String -Pattern "NgcKeyImplType"

NgcKeyImplType: 1 (0x1)
NgcKeyImplType: 1 (0x1)
NgcKeyImplType: 1 (0x1)
```

Cheers
MikeT
1Password Team
4 years ago
Hi gussic,

Can you do the following for me, it'll let us know if your Windows Hello key are in the software provider or the TPM provider:

Click start and search for Powershell, open it

Enter the following command: certutil -csp "Microsoft Passport Key Storage Provider" -key -v | Select-String -Pattern "NgcKeyImplType"

Does it output 1 (0x1) or 2 (ox2)?

It should show something like NgcKeyImplType: 1 (0x1) if it is in hardware TPM provider.
gussic
Super Contributor
4 years ago
Upgrading to the newest nightly did not fix the TPM issue for my intel based machines.
1P_PeterG
Community Manager
4 years ago
Excellent news, @KimBje. 🙌 Thank you for letting us know - and we hope you enjoy the feature from here!