Remove ability to sign in with windows PIN

[jens120]

I'm not sure if this is possible but it would be good to have the option to remove the ability to sign in with the windows pin instead of biometric data. Windows pin is probably less secure than the keepass password

[danielhoegel]

Removing the PIN option is also a huge deal for me as a PIN is usually very unsecure. As long as this plugin allows a PIN as an alternative to a fingerprint or a face recognition it is not usable for me.

[MartinKolarik]

The plugin just uses whatever methods you have configured in Windows. If you use biometrics to log in to Windows, can't you remove the PIN option in Windows log in settings?

[danielhoegel]

@MartinKolarik No, Windows always requires a PIN as a fallback if you want to use any biometrics. Does the Windows Hello API not provide any way to restrict the available options?

[shuffle-c]

@MartinKolarik No, Windows always requires a PIN as a fallback if you want to use any biometrics. Does the Windows Hello API not provide any way to restrict the available options?

It does not, so far. There is a little chance that further Windows updates will extend its functionality yet I wouldn't count on that.

[wojciechka]

I do not think Windows requires a PIN to be present. It is configured by default as it is more convenient than password as a fallback, especially on 2in1 devices, but it is possible to disable PIN.

I just went with process of deleting the PIN, ensured I cannot use it and then creating the PIN again. Everything worked properly:

(despite the screenshot not showing it, I am using Windows Hello and face recognition on Surface Pro)

The version is Microsoft Windows [Version 10.0.19041.21]. This is an insider build of Windows 2010H1.

Edit: After trying it again I noticed that this does remove ability to sign in using facial recognition. Which is also what the message in the screenshot said. So, now I agree with the original submitted that it is not possible to disable PIN as fallback, at least when using facial recognition. I'll check on another computer with fingerprint reader later, but I suspect it's the same.

[MartinKolarik]

@danielhoegel that's interesting because without biometrics the PIN is optional and you can keep using the full password if you want to.

Does the Windows Hello API not provide any way to restrict the available options?

I don't know the Hello API in detail but it seems unlikely because AFAIK all authentication methods provide the same level of access, i.e. if you elevate privileges by typing a PIN you have full control of the account, just like with a password.

[wojciechka]

After re-checking things I noticed that indeed it is not possible to remove PIN as fallback.

However, configuring whether PIN can be used is not something a tool like keepass should be handling.

I consider a 4 digit PIN a good fallback if used occassionally - such as when sunlight prevents face recognition from working properly. It is only not secure if being the default and typed in frequently.

If you do not agree with the above, a PIN can be set up to include digits and letters - then it is not limited to 4 digits and a password can be set up this way. PIN is also backed by TPM and it has measures to prevent brute forcing of the password:

https://docs.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password#what-if-someone-steals-the-laptop-or-phone

https://docs.microsoft.com/en-us/windows/security/information-protection/tpm/tpm-fundamentals#anti-hammering

Finally, I consider ability to unlock my computer (which you could still do with a PIN if it is enabled) a larger security threat than just unlocking my secrets. When someone accesses my computer, he/she can install any software that does not require administrative access (such as keyloggers) - and even if it would not be enough to capture Windows Hello prompts, I would be more vulnerable this way. So, if you do not trust your current PIN to be secure, I would recommend setting up a more complex PIN as a guessable PIN is still a serious security issue in the context of unlocking your device.