Windows 11; Windows Hello; Require password (or PIN) on app start; Key encryption

[Neuron5569]

OK. I think I found the answer. There are TPM 2.0 vulnerabilities affecting computers probably being shipped since 2016. Maybe for some, TPM key storage can no longer be trusted. VU#782720 - TCG TPM2.0 implementations vulnerable to memory corruption .

See also this thread:

Does bitwarden save master password in TPM

Dear @paulsiu , Have you ever gotten more info on this? Apparently, 1Password differentiates using TPM/not using TPM. While not using TPM, 1P requires re-entering password on restart. If using TPM, 1P doesn’t require entering the password, but will warn about other malicious apps. BW recently added the option to require re-entering the password on start for biometrics, while recommending that Windows users leave this option on as it is better for security. So, presumably, BW has never stor…