0

Is there a difference in storing fingerprint information with a PC with and without TPM/Intel PTT on windows 10 and, how secure is it?

  • It is about as secure as the Fingerprint data on your iPhone or any other version of Windows that has native support for fingerprint authentication in other words its more secure then it used to be when the OEMs would provide third-party software to allow fingerprint to log you into your Windows profile ( that was indeed broken ) – Ramhound Jan 21 '16 at 16:18
  • @Ramhound not quite – Linef4ult Jan 21 '16 at 20:45
  • @Linef4ult - If you are going to say I am wrong then back it up with a reliable source or provide an answer that disagrees with me that (again) uses a reliable source. In my experience fingerprint support before Windows 8 was broken, because OEM software, stored the data in an insecure way. Since Windows handles that support naively it is more secure, about as secure as Apple keeps the data, on their devices though since the extracted data isn't very helpful. – Ramhound Jan 21 '16 at 20:56
  • @Ramhound Just did. Apple 1 Up'd all the other players with their "Secure Enclave". – Linef4ult Jan 21 '16 at 21:02
  • Have not followed how Apple fingerprint authentication worked for over 3 models years now, which is about 2 years give or take, shouldn't have used Apple as an counter example. Of course only a hash of the fingerprint is stored in either case, its just because of this module, can Apple use it for more then just authentication. – Ramhound Jan 21 '16 at 21:12
4

The TPM just stores keys to verify code that will be executed/booted, its not like the secure enclave Apple developed for touch ID. With the secure enclave fingerprint markers are stored in an integrated circuit that has no way of revealing them, only comparing. Win10 devices can at best encrypt them and then store them on disk. In theory they are recoverable if difficult to do so.

As an aside, they're a terrible method of authentication since revocation is completely impossible, as are all biometric methods. If I set up a private key, or a password, and somebody gets their hands on it, I can revoke that key or password and configure a new one. If somebody gets my fingerprint, they have it. The only thing I can do is abandon the entire authentication system.

| improve this answer | |
  • If I set up a private key, or a password, and somebody gets their hand on it, I can revoke that key or password and configure a new one. If somebody gets my fingerprint, they have it, only thing I can do is abandon the entire authentication system. – Linef4ult Jan 22 '16 at 13:26
  • Strange, my HP Elite x2 1012 G1 has a BIOS/UEFI option offering me do delete my fingerprints. How come the System Setup offers this option when fingerprints are not stored somewhere in hardware (TPM)? – AxD Dec 9 '18 at 20:19

Not the answer you're looking for? Browse other questions tagged or ask your own question.