Why am I being asked for a Passkey? How do I turn off passkeys?

Yes Jay, we still agree, just see different sides of the issue in certain cases.

The Amazon issue you describe, though different than mine using Windows 10 and actually trying to use the Amazon passkey via first my Pixel 4a5g and then later a Pixel 8 upgrade early this year, resulted in an even worse set of experiences I'll briefly describe.

Though it's supposed to be easy to use this cross-device passkey authentication as long as Bluetooth or a similar technology is enabled on both devices, I found this impossible with the initial 4a5g current with Android 14 at the time, and then flakey but basically functional with the Pixel 8 that shipped with Android 14.

The problem with the Pixel 8 wasn't the device, but rather the flow and really just the decisions made by Amazon, since though I can't recall the specific issues I had setting up the passkey, the process seemed unnecessarily complex and didn't even make sense to me, so I'd expect the average consumer to simply be lost.

The bigger issue for me at the tine though, was that Amazon apparently only saw the passkey as a password replacement and for some reason, not the full 2-Factor authentication process that it is, since it inherently requires both something you have (Private Key on local device), to be accessed using something you are (Biometric - Windows Hello Face in my case), or know (PIN) that's then presented to the website along with the public key during the challenge/response sequence that's part of the protocol.

I described this process so you can see that passkeys are really already 2-Factor, so the requirement by Amazon at the time to also still require that I complete the authentication using the legacy TOTP interaction that they made available for 2FA a year or more ago, was simply pointless overhead. Since using the passkey via the smartphone also requires the added step of accepting the Biometric or PIN and I believe a second popup request after that's entered, this was already nearly as much work as the TOTP interaction but adding that legacy step was simply outright stupid.

Thinking about your last description of the experience with the security key sounds just as stupid, so this is precisely what I was meaning when I said it's the inconsistent process, in this case including not treating either the security key or in fact the passkey sequence alone as 2-Factor that's really the problem. Amazon has stupidly decided to instead 'layer' these disparate means of 2-Factor on top of each other, creating a pointlessly excessive set of redundant sequences that as you mentioned, will only cause people NOT to use them even if they are actually more secure. I'll leave that portion of the subject here, since I think we now totally agree that it's Amazon's decisions regarding this process where the true problem lies in that case.

I'll mention that I understand this is why those using security keys dislike the Windows dialog prompt as well, but in that case, I can see that Microsoft has a somewhat more complex set of potential issues to deal with, such as added users with Kiosk or other multi-user systems who may not use the same security key or similar device as another user of that same system. How to allow the branching logic required in order to support anyone who might use that system, while still streamlining this process for those who use it regularly, is really the problem. Though creating some sort of override that allows the device owner (Admin) to set this default, while still providing some sort of 'out' via a clickable link to allow temporary access to someone else might provide a solution.

As for the TOTP portion of your response, I realized after my last post you might interpret it to mean killing off both that and other methods instantly, while in truth what I should have stated is that no future effort should go into legacy options like TOTP, assuming that the core issue of phishing these 'secrets' can't be resolved that is. The problem for most websites using these is that they have no way of knowing whether you're using a password manager or other secondary device unless there's some sort of layered software involved that the website interacts with, which as I understand it, some of these 3rd-party devices might actually have.

My comment was focused on consumer accounts that in most cases won't be using such added devices, while the FIDO2 passkey system inherently requires some form of authenticator, as well as has varying degrees of ability defined for these, which both allows an authenticating website to confirm that the authenticator fulfills its specific requirements, as well as providing the ability to upgrade and future-proof the method. I suspect this requirement was created at the request of these 3rd-party authentication device manufacturers, precisely in order to allow those like a Password Manager feeding TOTP codes to be identified and approved by sites that support them.

Rob

My criticism isn't about using passkeys/Windows Hello to authenticate to *Windows* nor even to Microsoft cloud apps.

It's about (the specific case that brought me to post this, e.g.) Amazon doing (I don't know what) when the user goes to login that causes Windows to pop up a "create a passkey" prompt for an *Amazon* login, for which the user doesn't have (and doesn't want) a passkey.

You're right that it's the user experience of the implementation that is the horrible problem here. I'm not sure whether the formalizers of the passkey standard could have included a statement like "the user experience around how a passkey might be requested/offered is not allowed to suck" 😅.

All of the big tech companies shoveled a massive pile of sh*t onto a billion users with the poor quality of the user experience engineering that went (or, more likely, didn't go) into the current mess.

I also disagree with your assertion that maintaining TOTP is untenable. It simply isn't practical for technology designers to foresee all possible use cases. (See some of the top answers in this Quora post about the automation in the Airbus A320 aircraft: https://www.quora.com/Do-pilots-hate-flying-the-Airbus-A320-What-are-its-issues-and-quirks I asked an A320 pilot, years ago, what he thought of Airbus' "our engineers can think ahead of everything better than you human pilots can respond to the unexpected" philosophy. The answer was "Under normal circumstances the A320 series is a dream to fly. When sh*t goes sideways it's harder to fly and more likely to be involved in an incident".

Yes - with a not-sucky user experience - to-something-actually-stronger-than-what-the-user-is-currently-using gentle persuasion would be a good idea.

No, forcing people to any one solution and obsoleting others that *can* be strong enough (which is for me to decide, not for Microsoft/ Google/ Amazon/ you to decide) is not ok.

Okay Jay,

I see your various points as a past security professional myself, but I disagree that retaining the TOTP or similar legacy systems is viable, since they're inherently flawed unless the entire user population is forced to migrate to password managers to use them, which we both know is unlikely to ever occur. Putting that effort into FIDO2 and the passkey interface is really the better path.

I basically agree with your initial statement that the difficulty of using the current interface is a stumbling block to acceptance and feel that though the FIDO Alliance took nearly a decade to get the core technology working, they spent too little time defining these interface requirements before releasing them to the general user population. It's really the inconsistency in implementation that's the deeper issue, while this Microsoft choice is simply one example of the worst sort of side effects.

I can't really address your specific statements regarding the security key use, since having the preferred Windows Hello option instead with my Surface Go means I won't see the initial issues that those using other methods do when first authenticating Windows, which is likely where the true problem we're discussing lies.

In fact, I've realized that this is likely why many don't understand they've actually already initialized Microsoft's passkey system by selecting Windows Hello, since this is the base over which the system operates, so they've inherently already got a Microsoft passkey if this is enabled.

Unfortunately, if you've seen the chaos that the current state of authentication is causing for everyone, especially consumers, Microsoft and the others can't really wait around to get the entire passkey system polished like they typically might. Instead, they'll need to focus on this issue in order to get at least their Windows 11 user population migrated as soon as possible, though I don't think they should even make this attempt with Windows 10 unless they decide to provide exactly the same management tools there, since that's another can of worms entirely.

Rob