Why am I being asked for a Passkey? How do I turn off passkeys?

I agree with Shawn Frey, I don't get why we are obliged to use a passkey, in the end, all is the same; we are asked to identify ourselves with a code. I don't see what advantages have to add another code, it makes users and software confused. We already have sooo many passwords, passkeys, codes, etc for the bank accounts, work, clubs, etc to add another one to the layer.

Sadly all these security measures are more of a bother to the user than a real protection against hackers. These last ones are quite more advanced in technology than the normal user, and if the big companies add another layer of protection, the hackers will eventually crack it.

Hi Rob,

About account recovery, you're focused too much on the tech; I'm focused on the legal. If I send a notarized signed document claiming my identity and backing it up with, say, a copy of my passport, then for legal purposes I am me, and Microsoft can trust that to recover my account. To a certain degree this could be challenging if my name would be "John Smith" living at "123 Main St"; one option - and it should be optional - would be (under the strictest of "we will use this only for account protection" contractual privacy commitments) to allow users to provide a greater degree of proof of their identity at the time of account creation, to better allow matching at a later time of need for account recovery.

The United States has a structural distrust of central government (and, although now diminishing for very good reasons, excessive trust of corporations); I've lived in Europe for the past seventeen years, where it tends to go the other way; it is *trivial* for me to prove my identity - I have a national police issued ID card with an embedded digital certificate bound to my national ID number, and most truly-personal accounts (even down to many e-commerce sites) gather that ID (for tax purposes), so I could prove who I am for the purposes of account recover with nothing more than a web request form digitally signed by my ID card.

Even in the US, online automatic global identity document verification services have long existed (see how ID.me performs its online sign up).

This stuff is not rocket science. It's much more law, politics, and (problematically, unbridled) capitalism/ commercialism.

We, in security and in usability, must know and remember - and instruct our bosses - about the legal and societal stuff surrounding our tech toys.

Microsoft has most certainly not gotten (or, at high commercial levels, chosen to ignore) this fact.

Going back to usability, you continue to fall into the falsehood of "The only application I'll ever run on my computer is Lotus 1-2-3" (this was the impetus of Microsoft creating the in-account application virtualization and eventually-enforced proper shared libraries), which of course today takes the form of "I'll only ever use Apple products". But, we don't; we do use multiple applications, multiple platforms. This "Windows Hello is GREAT IFF you ONLY use Windows" is not an acceptable argument for pushing the use of Passkeys. Not until true, uniform user experience, cross-platform synchronized passkeys, withOUT the trivial confusion of "is that really a passkey prompt or is that a clever hacker's browser iFrame?!", are deployed.

And physical external keys like my handful of Yubikey FIDO2 keys are NOT simple. They're very secure, but they're a nuisance. They would either require (even assuming that most accounts allowed multiple passkeys to be associated, which most accounts do not) owning multiple of these things, to keep one each in each of the various places where I usually computer, or would require me to dig me one portable FIDO2 key out of my handbag over and over and over and over and over again throughout the day... just not practical.

You are correct in your underlying theory, but your insistence that it's practical or usable *today* is simply wrong with current implementations, and I see no evidence of real movement toward the converged, well- (usably)-implemented version that would make passkeys an actually good idea for most people any time soon. (And even then, reducing authentication to the one single factor of "my device" remains a bad idea, weaker than whatever other authentication method + a physical second factor; yes, modern Windows kernels are much harder to get into to the depth that would allow directly accessing the TPM, but how hard is it for user-level malware to act like the human user and tell the passkeys prompt "yes, that's me, hackhackhackhackhack the website that just foolishly trusted only Windows Hello on *this* device to prove *that* identity?).

[quote]Since the primary Windows Hello process and Private Key are contained within the TPM firmware and kernel of the device, this would require a complete compromise of the firmware or core drivers of the device in order to compromise a Microsoft account, which though theoretically possible with some modern malware, it's far less likely than it used to be unless the device owner himself became directly involved in the compromise during otherwise normal operation.[/quote]

😂 That's funny.

Especially since a lot of this has become about social engineering.

Let's talk about Windows. Windows is an operating system where an install program will commonly ask for administrator privileges, which just so happens to look exactly the same as a prompt requesting full access to every device driver, the ability to install its own device drives, operate in ring 0, read the entire kernel and userspace memory, and in herbal just go ham.

When you click this install button, EVERYTHING is on the table with the possible exception of removing files owned by SYSTEM.

This is how anticheats operate for example.

Nothing is secure in Windows because it is completely trivial to social engineer people due to the terrible security model. The TPM doesn't solve anything.

It does on mac where applications are installed without admin privileges by just dragging programs into the Applications folder, and then you are asked for individual granular permissions when they want to do something, or on Linux increasingly where systems like Flatpak allow installing and sandboxing in the same way.

Microsoft did develop AppX for a similar purpose, but it has failed to gain traction.