Why am I being asked for a Passkey? How do I turn off passkeys?

I have now learned that it is a waste of time to ask any question on a microsoft affiliated site. The following very minor registry edit that I found elsewhere worked.

Disabling Passkey Prompts via Registry Editor

1. Press the Windows key + R to open the Run dialog.
2. Type "regedit" and press Enter to open the Registry Editor.
3. Navigate to the following key:
HKEY\_LOCAL\_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System
4. Right-click on the right-hand side of the window and select "New" > "DWORD (32-bit) Value".
5. Name the new value "NoPasskeyPrompt" and set its value to 1.
6. Close the Registry Editor and restart your PC.

EndFragment

Hi Rob,

About account recovery, you're focused too much on the tech; I'm focused on the legal. If I send a notarized signed document claiming my identity and backing it up with, say, a copy of my passport, then for legal purposes I am me, and Microsoft can trust that to recover my account. To a certain degree this could be challenging if my name would be "John Smith" living at "123 Main St"; one option - and it should be optional - would be (under the strictest of "we will use this only for account protection" contractual privacy commitments) to allow users to provide a greater degree of proof of their identity at the time of account creation, to better allow matching at a later time of need for account recovery.

The United States has a structural distrust of central government (and, although now diminishing for very good reasons, excessive trust of corporations); I've lived in Europe for the past seventeen years, where it tends to go the other way; it is *trivial* for me to prove my identity - I have a national police issued ID card with an embedded digital certificate bound to my national ID number, and most truly-personal accounts (even down to many e-commerce sites) gather that ID (for tax purposes), so I could prove who I am for the purposes of account recover with nothing more than a web request form digitally signed by my ID card.

Even in the US, online automatic global identity document verification services have long existed (see how ID.me performs its online sign up).

This stuff is not rocket science. It's much more law, politics, and (problematically, unbridled) capitalism/ commercialism.

We, in security and in usability, must know and remember - and instruct our bosses - about the legal and societal stuff surrounding our tech toys.

Microsoft has most certainly not gotten (or, at high commercial levels, chosen to ignore) this fact.

Going back to usability, you continue to fall into the falsehood of "The only application I'll ever run on my computer is Lotus 1-2-3" (this was the impetus of Microsoft creating the in-account application virtualization and eventually-enforced proper shared libraries), which of course today takes the form of "I'll only ever use Apple products". But, we don't; we do use multiple applications, multiple platforms. This "Windows Hello is GREAT IFF you ONLY use Windows" is not an acceptable argument for pushing the use of Passkeys. Not until true, uniform user experience, cross-platform synchronized passkeys, withOUT the trivial confusion of "is that really a passkey prompt or is that a clever hacker's browser iFrame?!", are deployed.

And physical external keys like my handful of Yubikey FIDO2 keys are NOT simple. They're very secure, but they're a nuisance. They would either require (even assuming that most accounts allowed multiple passkeys to be associated, which most accounts do not) owning multiple of these things, to keep one each in each of the various places where I usually computer, or would require me to dig me one portable FIDO2 key out of my handbag over and over and over and over and over again throughout the day... just not practical.

You are correct in your underlying theory, but your insistence that it's practical or usable *today* is simply wrong with current implementations, and I see no evidence of real movement toward the converged, well- (usably)-implemented version that would make passkeys an actually good idea for most people any time soon. (And even then, reducing authentication to the one single factor of "my device" remains a bad idea, weaker than whatever other authentication method + a physical second factor; yes, modern Windows kernels are much harder to get into to the depth that would allow directly accessing the TPM, but how hard is it for user-level malware to act like the human user and tell the passkeys prompt "yes, that's me, hackhackhackhackhack the website that just foolishly trusted only Windows Hello on *this* device to prove *that* identity?).

You are indeed right that it only applies to S mode, but that's is because Microsoft locks the whole computer down, which is unacceptable, not because they made any architectural improvements.

It's supposed to lock the applications down until the user specified otherwise, not the user itself!

Asking for permission to use the camera should happen at device driver level, not appx level. Applications should have their file system sandboxed. Local/LocalLow/Roaming is good, but the system needs to ask if the application tries to read or write outside its own folder or those folders.

The system should ask if i am application can write files in system folders or the registry. Regedit and Explorer get a carte blanche.

Applications need to be able to specify to the OS that you should not be allowed to debug it or read its memory.

Applications should be able to specify that their window cannot be recorded, and again this happens at display server level so no applications can. They just get s as black box instead. You already have it for DRM, why can't an EXE ask for this?

And applications need to **** of the kernel, period. Especially anticheat. Popping up saying it needs to be an administration isn't enough. It needs to pop up saying "this application wants to install a driver to get full access to all memory in your system, are you okay with this?"

Both Apple and flatpak has proven this can be done with any binary. Get to work.