Why am I being asked for a Passkey? How do I turn off passkeys?

< SNIP >

The passkey popup you refer to comes from Amazon. They offer you the opportunity to sign in with a passkey instead of a username/password combination. If you agree, they will setup a passkey for you. Microsoft is not involved.

If you find Amazon's process confusing, you should complain to Amazon.

Chien Sage and others,

I'm quoting this portion of your text only as an anchor, since there's several branches here now where we've all hijacked SirBlain's thread to discuss these issues with passkeys, but I believe it's the best place available currently due to the critical piece that NeighborDave0228 provided above via the following URL.

https://fy.blackhats.net.au/blog/2024-04-26-passkeys-a-shattered-dream/

To try and clarify the problem this developer exposed, the issue is actually within the FIDO Alliance WebAuthn specification, where the Authenticator Selection Extension (authnSel) and possibly other extensions that were removed from the Level 2 spec mention in the w3c/webauthn thread he linked within 'The Warnings' section of his blog article, create a quandary for developers attempting to support passkeys.

Since this effectively breaks portions of the cross-platform portions of the spec, it leaves it to developers like Microsoft as a platform and Amazon as a potential website target for these services, to decide how to manage these issues between the Level 1 and Level 2 (and possibly later definitions of the spec that may have come since) are resolved and supported in their own implementations of passkeys.

Since the developer's blog is from 26 April 2024, we don't know without further research what's changed in the specifications since, but his own description of the general degradation to workarounds and platform specific solutions to that point is precisely what I'd have expected as a result.

My own previous comments here or in other threads that the various developers should follow the spec or major participants should provide guidance were made without knowledge of how the spec itself had apparently diverged and devolved since that point, or anything that may have occurred since. If it remains in a shambles or become even more fragmented since then, this means there's simply no stable base upon which at least cross-platform or 3rd-party authenticator development can be performed.

That's why I stated in my previous post that the blog article explains virtually everything I've seen, since regardless of any particular interface or other issues an individual website implementation might have, if the spec itself has diverged, they'll never be able to build something that works for every possible revision or possibly any cross-platform support at all.

That's likely why I was seeing my own issues with creating and eventually using the Amazon passkey with Windows 10, which though it supports Windows Hello as an anchor, has no local authenticator or management console for these, and as such depends on the Android phone authenticator in a cross-platform mode that has questionable support, along with other issues related to Google's own implementation as the developer's blog article also mentioned.

It's also clear from this why the confusing sets of multiple menus with no clear pathway to perform the creation or use of passkeys in Windows, since the workarounds required to resolve all of the possible issues leaves no other option.

It's also why I almost immediately saw the need for Microsoft to create their own authenticator within Windows itself, but that's precisely the undesired platform specific implementation you'd rather avoid. The reason for this is that if only a local platform implementation can work, regardless of the fact that might be simpler for users, it removes the ability for any external key backup outside a single platform and potential loss of the entire set of private keys as a result.

We've already seen the results of a similar parallel set of issues with the Microsoft Authenticator, which though designed cross-platform by default using only Android or iOS-based apps, is riddled with common user issues such as backup and recovery of even the associated Microsoft Personal account if the smartphone is lost, damaged or simply traded in or factory reset.

The key problem with using any of these is simple, the private keys for any of these are contained on the phone, but generally invisible to the user, who only typically sees the authenticator app as just that, like any other app that can be reinstalled at will. Understanding the virtual aspect of even relatively visible TOTP Code keys stored in the smartphone is difficult. Making them even less visible as is the case with passkeys means that only the most technically capable and able to visualize among us can hope to picture what's truly happening, unless the interfaces are designed to be simple and obvious to help the user visualize what's actually going on.

Rob

No need to complain to Amazon. Again, you're missing the point. I'm saying the whole passkey thing is not user-friendly and I seriously doubt it will catch on. I do appreciate your apology. No offense intended on my part either. I just find the answers to questions (raised earlier) exasperating. But I won't continue posting or inquiring about this. All the best to you.

However, you also mentioned earlier that passkeys don't require a brain to use. Well, how nice. So, we may as well leave such time-wasting discussions as these to the braindead. Have at it. Enjoy your passkeys!

I actually edited my reply to remove what I originally wrote about being brain-dead. I realized that was rude and I apologize for having written it.

The passkey popup you refer to comes from Amazon. They offer you the opportunity to sign in with a passkey instead of a username/password combination. If you agree, they will setup a passkey for you. Microsoft is not involved.

If you find Amazon's process confusing, you should complain to Amazon.