Why am I being asked for a Passkey? How do I turn off passkeys?

They have more chance of guessing a 4 digit pin than a 8 character password which is far from easy to guess. Do you work for Microsoft?

You're making the same obvious mistake that everyone who doesn't understand what a Window Hello PIN actually is always makes, since there are multiple reasons what you're stating is incorrect.

The 4-digit PIN only works on the device itself, while the password is for your Microsoft account that's accessible from anywhere in the world, meaning that an attacker can't use the PIN unless they have physical access to your device.

If an attacker gains access to your password via any sort of remote attack such as a website hack or installing malware on your device and either capturing it with a keylogger or getting it from a locally installed password manager app including stored within the Edge browser, they have one set of information required to access your online account, which is why 2FA is so important.

Your PIN can't be captured via a keylogger app because it's entered when Windows isn't running (locked), and it's stored encrypted within the TPM module, so it's never accessible in text form anywhere even in the PC itself, it's just verified against the PIN you enter locally on the PC keyboard and if correct, you're logged into Windows locally.

The TPM has anti-hammering protection that for version 2.0 locks the TPM after 32 tries, after which new entries are ignored until 10 minutes are elapsed and one additional try is allowed, again locking on failure, while waiting for 320 consecutive minutes with the device powered on allows the maximum of 32 additional tries. This 10-minute countdown timer only operates when the device is on or in sleep mode, so if the device shuts off automatically the number of tries remains constant. For this reason, I personally changed my own Windows 10 PIN to use 5-digits, so even if a thief has possession of the device, they'd need to realize that first, and then the number of possible PIN values increases from 10,000 to 100,000, while you can make that value even larger or I believe use alphabetic characters as well, though the risk of forgetting it yourself increases as a result.

If you lose the device to theft, a thief will typically just reinstall Windows to sell it anyway, so unless you personally are a high-value target like a billionaire or similar, it's unlikely anyone would bother to try even 4-digit codes for many hours, days, or weeks (up to 7 days in front of the device trying a new code every 10 minutes if they work constantly and don't make obvious mistakes like retyping the same code, etc.) to access whatever it contains, by which time you should have either locked the device through your Microsoft account or hopefully managed to find it.

Once the correct PIN is typed, Windows Hello uses your Private key stored encrypted in the TPM in a challenge process with login.microsoft.com to generate a transient passkey that's sent to the server to login, so no actual password is ever used or stored anywhere in this process, thus it can't be directly hacked like an actual password can. Without the Private key, the passkey itself is useless, so even if someone could capture it from the network, it'd be useless from anywhere other than that device at that particular time, so it can't be easily phished from the user himself like TOTP codes from your phone, email or even an Authenticator can.

I've likely forgotten at least one or two other reasons a TPM-based PIN is more secure than a password, but hopefully you're beginning to get the point. A Windows Hello PIN is far more secure than any password can ever be, regardless how long, complex or careful you are personally about protecting it, since in reality it's simply a shared secret that you know that unfortunately the other end of the login connection must also know as well, while with a passkey involved, the website on the far end stores and uses its own Private key that's used along with your Public key to sign the challenge data they send during the process of requesting your passkey to confirm your identity, since your passkey actually contains that information and no username is actually needed with passkeys at all.

Here's a search with multiple articles that likely say at least some of what I've stated above to verify if you wish. They likely say some of it in easier to understand language, I won't bother to look since I know enough already.

Windows PIN vs password Microsoft.com at DuckDuckGo

Amazon has some of the most annoying and I believe incorrectly implemented use of passkeys I've seen, which along with issues with passkey use on Windows 10 is why I've decided to wait until I get a Windows 11 device to use them. Even so, since Windows 10 has no built-in authenticator, I was able to stop Amazon's prompts for the passkey by simply disabling the Google Password Manager on my Android Phone, which since I use the Microsoft Authenticator instead wasn't a problem for me.

Maybe it's a bigger problem with Windows 11, but I don't know why it would be, and I'd personally just start using passkeys instead if I had 11 anyway, since it's simpler and more secure for well implemented websites.

Yes, there's lots of complex things to understand regarding Windows Hello, PIN's passkeys, etc., if you only feel safe if you understand them fully. But using them is far easier than that once you're properly setup with Windows Hello on Windows 11, so anyone with that should just start using passkeys instead. I know I would.

Rob

Moronic indeed. What a mess.

Good grief.