Why am I being asked for a Passkey? How do I turn off passkeys?

Microsoft's problem is the combination of these other issues, since by trying to still follow the standard as written, it's resulted in the creation of the ever-increasing mess of menus and other complexity that's driving users nuts, including myself which I'd initially ascribed only to Microsoft having left passkey management completely out of Windows 10, I assume in an attempt to force users to the Windows 11 platform, but leaving an extremely bad taste in the mouths of those like SirBlain and others coming in utter confusion to relatively complex discussions like this one.

Unless Microsoft can force a reset with the other major developers like Google and Apple, the act of taking the passkey systems into a platform specific implementation may allow them to solve some of the problems and simplify its operation, but the fragmentation this creates will obviously kill the cross-platform options for authenticators which is precisely what Google claimed they were trying to protect when that initial standards definition failure occurred.

Unfortunately, if these issues can't be resolved, as at least one of you has stated, this all leaves only the technically skilled among us with any useable combinations of passwords, managers and/or 2FA using authenticators, since the complexity of operating, maintaining and recovering those is showing up in these forums as problematic for most typical consumer users as well.

Certainly, this whole thing starts with Amazon popping up a system prompt without asking first and we're all confused. And of course it will end up setting up passkeys in addition to passwords, which means it doesn't provide any protection because my insecure authentication method is still out there. That's how we got here.

But once I found out what Passkeys were, the problem quickly turns into Microsoft again for a whole host of reasons.

Firstly, it pops up a modal dialog box. Now I can't use Firefox at all until I decide to finish my login to Amazon. Okay, that's kindda stupid, because what it means is I should in theory be able to pop these dialog boxes up whenever I want and just really annoy you with them. I wonder if you've inserted any protection against putting them in ads? If not, that could be fun. Just to randomly annoy people.

Anyway, this modal popup offers me to log in with the pincode to my computer. Because of course, my desktop PC does not have biometric sign-in, and even if it did you can still use the pincode. Now, the pincode has a much lower security than my password for my password manager, because my password manager's password is much longer and uses letters and symbols as well.

Once we get past all this terrible security of having 3 different ways to compromise my account, my passkey gets saved on my passwords database. Where is that? Well, let's search for it on Windows! So I search for passkeys. I get nothing except the chance to open Bing to search for it in my least favourite browser. Now, an idiot or extremely tech illiterate person (such as a very old retired plumber, let's say) is going to stop here and get confused, but thankfully for me I am a software engineer, so I decide to look through the now open browser and find out about passkeys in English.

So I write "pass" into my search bar now and find "Administrer netværksadgangskoder", which is the old passwords page from Windows Vista. It does not have passkeys. Because the people who worked at Microsoft at the time were actually smart and knew that passwords = adgangskode, I would assume therefore passkey should be adgangsnøgle, but it isn't. Microsoft just sort of forget about that because the current Windows team is absolutely clueless.

I go back on the internet and find out that it is in settings. So I go into settings and I look into "Sikkerhed", which doesn't help because that settings panel is absolutely huge since Microsoft just can't help themselves but make my system insecure by harvesting literally all my data and all the data about my dog unless I withdraw consent, and here are all the 3 billion ways in which I can withdraw consent.

Alright great, so now I look it up again and find out it's under accounts. After scrolling past the advertisement for a PC Game Pass and Office 365, which are products that I don't want to buy and almost instinctively turns my away from that settings page if I can help it because I hate ads, I find them under the name "Adgangsnøgler". I would think that accounts would be Windows accounts since this is Windows settings, but okay.

I can't interact with these things at all. I cannot open or see them, I cannot copy their information. I really just can't do anything. They are glued into my Microsoft account. Further still, the settings page is not called "Adgangsnøgler" in search, it's called "Indstillinger for adgangsnøgle" which is grammatically incorrect (direct translation is Settings for Passkey) and also inconsistent. Furthermore, if I search for Adgangsnøgle and hit enter a little too fast it goes on Bing instead of opening the passkeys window because Windows searches the web faster than your computer, which is INSANE but a topic for another time, and woe be the day where the first result is a scamsite ad at the top of the search results... Worse still, searching for "Adgangsnøgler", which if you recall is the name of the settings panel, will not include "Adgangsnøgle" because that doesn't contain the plural r at the end - the plural r which must grammatically be there, so it isn't found when searching for the actual title of the settings panel.

But that's okay, because I still have KeePassXC and it has support for passkeys! And not only does it have support for them, I can see information about them and export them into JSON files. Oh wow, imagine that. Good thing too that gives me a popup saying don't leave these files lying around. Good advice!

So how do I put passkeys into KeePassXC? Well.... Microsoft's implementation simply does not offer that option. Amazon will popup the Windows security dialog on Firefox or Chrome, and it has no option to use KeePassXC. Fortunately, KeePassXC has a workaround for this! Through an extension it can hijack the prompt, and then KeePassXC will offer the key instead. Okay.

So now I can use cross-platform passkeys. Or at least my browser can, if I want to use something that isn't my browser, such as the Discord desktop app for instance, that simply wouldn't be possible even if they did add the option. Not so great. What's also not so great is that the Amazon implementation glitches out when trying to create a passkey. I can use those that I have, but I can't make new ones. It works elsewhere. Obviously something as simple as hiding your password behind biometrics should not be hard to implement for major tech giants... what?

So, finally we have arrived at our destination. The problem is not passkeys. I could indeed put a passkey into a password storage solution and I could indeed sync it across my devices however I wanted.

The problem is not with Apple, either, unless we count the part where they were apparently deleting them. That's obviously a bug, but if we look at what they actually implemented, we can see that within settings there's an integration popup wherein I can simply use Strongbox (aka KeePassXC on the mac) and now keepasses work systemwide. I don't have to fiddle with browser extensions or anything. Install the app, set it as default (it adds itself automatically) and go for it. Easy.

But my Amazon.com passkey is still stuck on my Microsoft account. As far as I can tell there's no way to get it out. Fortunately, I can use my oh so very insecure password to generate an infinite amount of passkeys, so it's going to be alright.

And then I come in here to be told that this thing is great and it's the future and it's the bee's knees.

It's not. It's an absolute joke and everyone involved with its implementation on Windows and at Amazon should be ashamed of themselves. The people who implemented the cloud sync should be ashamed. The people who did the settings panel should be ashamed. The people who didn't offer integration should be ashamed. The people who did localisation should be ashamed. The people at Amazon who popped it up and had it say "Firefox requests" instead of "Amazon requests" should be ashamed. Amazon for popping it up without me asking for it should be ashamed. The people who created the serverside part of this should be ashamed.

How can you advocate for this thing? Seriously now. Please.

First, we don't all sit around staring at our screens - so a delay in replies to your "offer" is par for the course. Secondly, I don't think an "explanation" is what's missing here. Did you read through prior posts in this meandering thread? Clearly the issue is that Microsoft has designed something ("passkeys) that end-users tried and found cumbersome and irksome. With the technical expertise of Microsoft, they surely could have made the use of passkeys simple, obviously valuable to average end-users and NOT something that requires all these explanations and detailed instructions.

Bottom line: No, not looking for a pitch on why passkeys, to use your term are "the future". Seriously?

This is a public forum. You can post an explanation if you want, you don't need anyone's permission.

Of course it won't be the future if we don't want to use it, regardless of its technical prowess, and so far it's not a terribly big success I must say.

Also, the vendor lock-in issue, which really is the problem we're talking about here to a rather great extent, is a huge issue. If I could have Windows save my passkeys into my KeePassXC account that would at least be better. Not great, but better.