Benefits of a TPM
Benefits of a TPM
Posted Sep 17, 2025 22:21 UTC (Wed) by NYKevin (subscriber, #129325)In reply to: Benefits of a TPM by smurf
Parent article: Providing support for Windows 10 refugees
> Both of these require physical interaction with the device (fingerprint on the phone, a physical button on the stick) which a TPM cannot afford.
The button on the USB security key is not a real security boundary, it is merely proof of presence. It exists to slow down lateral movement through a large (usually corporate) network, under the assumption that we've already been breached and the attacker would prefer to target devices that have a security key plugged in, but nobody sitting at them right now. It would be possible for the OS to require a SAK (i.e. "press Ctrl+Alt+Del to use your passkey for [domain]") as an effective substitute for a physical button, but I have never seen such a thing in practice. Consumer (home) networks are not large or trusted enough for this to be worth the bother of doing.
On the other hand, if you want to require secondary authentication (analogous to the phone's fingerprint reader), which really is a security boundary, the OS can request a PIN, and Windows does that in practice. This works both ways: Your phone will accept a PIN or pattern in lieu of a fingerprint, and Windows will accept a USB fingerprint reader in lieu of a PIN (if you've configured a fingerprint login, of course).