I guess I'm getting a TPM for Astaroth so I can do Windows Hello biometric authentication as securely as it should be.
I'm spoiled by the biometric auth we have at work. Heck, the Surface Go does face recognition. Why should a $4,000 desktop not have biometric authentication?
Gaming desktop with Windows Hello. Why not? It's just a matter of getting the hardware to do it securely.
It just feels like Astaroth is the odd one out when it comes to biometrics. My very first laptop had a fingerprint scanner, and that was nearly a decade ago.
Come Sunday, when I get that TPM and fingerprint scanner set up, that should no longer be the case.
Thoughts on biometric authentication?
(consider that fingerprint scanners are ubiquitous on smartphones these days...)
Some futzing around, as I've not found any need for legacy BIOS compatibility... CSM disabled, Secure Boot configured and enabled. Astaroth boots with no problems.
(while Secure Boot is not required for the TPM or Windows Hello to function, CSM must be disabled for TPM 2.0)
@djsmiley2k Not planning to. I'm mainly experimenting with more advanced security features.
But having the TPM there means that the PIN is actually backed by hardware-enhanced security as opposed to merely being another password.
When Microsoft implements passwordless sign-ins, this would enable me to disable the password, and the user won't be able to log in without getting past the fingerprint reader and TPM-protected PIN.
Obviously, the setup on Astaroth is not invulnerable to physical attacks, but it's more a matter of having a setup that replicates what's on my laptop and tablet, which both use Windows Hello with TPM-backed PINs.
(note that Astarothcan be configured to use BitLocker)
Long story short, I'm spoiled by the biometric authentication technology used both at work and on my mobile devices. I just want to do it the Right Way™ on my desktop, by using a TPM for the PIN just as my other Windows devices use.
