Why am I being asked for a Passkey? How do I turn off passkeys?

It's a little off-topic, but still germane to Microsoft's attempts to force users into using passkeys; your claim that Microsoft has eliminated any realistic opportunity for people to recover accounts is telling. This isn't because there isn't a reasonable way to prove account ownership - legal proofs of identity have been a thing for thousands of years. It's because the big tech companies don't want to spend the money to respect this most basic aspect of user autonomy, and regulation hasn't forced them to.

The 15-character-password adamant person certainly should have included "plus good 2-factor".

With the terrible (confusing, ripe for social engineering) user experience of passkeys today, competent unique strong password plus phishing-resistant 2FA is less likely to result in a user being engineered into giving up full access to an account; and the argument about keyloggers and other "game is already over, they've got control over the end-user's device" applies to passkeys to (and possibly in spades, because ANY out of band 2FA would defend against that, whereas "my device IS me" passkeys implementations are MORE susceptible once a user's device has been compromised).

Jay Libove - 2,

Well thought out issues, but I think you've missed something in your first and last case mentioned.

The actual reason that Microsoft has had to drop the ability for individuals to recover their personal accounts via Microsoft Support, which I should also have indicated is primarily when all of the account identity data has been modified by an attacker, since otherwise you could simply use the automated online form or similar automated method to recover it yourself, is that there's no longer any truly guaranteed method to confirm identity stored within the account.

You're correct that there are approved forms of identity like the now common US Real ID that was finally recently required for flying even domestically, though the federal law that mandated its use was initially passed in 2005. However, as you mentioned, no such ID requirement has ever been made for the use of Microsoft or most other similar personal online accounts except those like Airbnb.

Unfortunately, these accounts have over time become the rough equivalent of our personal web identity, which is why without the storage of and a method to verify something like the Real ID against the person making contact, since even using a person to perform this task creates the potential for employee-leveraged fraud, it's not likely we'll see this form of true ID verification at least until the AI apps have progressed to the point where the likely still optional storage of your Real ID with the account could be used to validate your identity. The problem I still see here though, is that Microsoft's recent changes to their own IR-based Windows Hello Face system to avoid face-ID spoofing, likely means that much better cameras may be required in order to make this sort of AI system effective.

As for the current passkey system, I agree it's still confusing and needs work to become fully effective for typical consumer use, though once a person understands how to initially create them on a Windows 11 system, their use from what I've heard is so easy that I don't believe that's really where the true user problems lie.

Though I agree there appears to be a theoretical potential for a kernel-based malware and bot to abuse a local authenticator, getting malware embedded that deeply into Windows isn't as common anymore, and even if it occurs, unlike with local password managers or other clear-text authentication methods like TOTP, neither access to the Private Key stored in the TPM nor the creation of a passkey that could be used from another device would be possible.

And it's still simple to avoid this issue by simply using a cross-platform device such as a phone or other external FIDO2 security key device to store and perform the authentication instead, since that's functionally similar to the out-of-band 2FA devices you mentioned, but with the added security that's provided by use of the TPM or similar phone-based encryption chip and no direct access to the Private Key it stores of any sort, since the FIDO2 challenge process doesn't allow for it.

Since the primary Windows Hello process and Private Key are contained within the TPM firmware and kernel of the device, this would require a complete compromise of the firmware or core drivers of the device in order to compromise a Microsoft account, which though theoretically possible with some modern malware, it's far less likely than it used to be unless the device owner himself became directly involved in the compromise during otherwise normal operation.

Casual malware operating outside of the kernel would never really have the ability to do any of this, so I find it far less likely than the compromise of any current authentication method, which as the Lumma and other similar infostealer malware have shown, can quickly collect passwords, transmit to C&C servers, and exit before their presence is even known.

Rob

It's a little off-topic, but still germane to Microsoft's attempts to force users into using passkeys; your claim that Microsoft has eliminated any realistic opportunity for people to recover accounts is telling. This isn't because there isn't a reasonable way to prove account ownership - legal proofs of identity have been a thing for thousands of years. It's because the big tech companies don't want to spend the money to respect this most basic aspect of user autonomy, and regulation hasn't forced them to.

The 15-character-password adamant person certainly should have included "plus good 2-factor".

With the terrible (confusing, ripe for social engineering) user experience of passkeys today, competent unique strong password plus phishing-resistant 2FA is less likely to result in a user being engineered into giving up full access to an account; and the argument about keyloggers and other "game is already over, they've got control over the end-user's device" applies to passkeys to (and possibly in spades, because ANY out of band 2FA would defend against that, whereas "my device IS me" passkeys implementations are MORE susceptible once a user's device has been compromised).

Rob thank you for the explanation regarding 'FIDO'. I don't know why Microsoft does not provide an explanation of what FIDO is, how it relates to their passkeys, and the purpose, use, set up of passkeys. All that I have seen is somewhat gibberish.

Here are some links by Microsoft with explanations.

• What is a passkey?
• What are passkeys? How do they work and how do they relate to FIDO2
• Passkeys Overview & Management

BTW...these security enhancements are the new norm in today's world due to hackers and the number of data breaches breaches reported where extensive amounts of personal/financial/business information (including usernames and passwords) is stolen by hackers, then leaked or published for sale on the Dark Web. Criminals can then use that information for identity theft, hacking, extortion and any number of other nefarious purposes. We as users of this technology must take steps to minimize the risk of all sorts of threats, not just Microsoft sign-in attempts. Passwords combined with multi-factor authentication (MFA) are no longer sufficient to fully protect you.

Passkeys Authentication Across Platforms - How Passkeys Registration and Authentication Work Across Devices and Platforms

Quote

To combat such risks, phishing-resistant Passwordless authentication methods, including enhanced support for Microsoft Authenticator, have become critical.