Why am I being asked for a Passkey? How do I turn off passkeys?

Interesting. I find almost no discussion at all on the Internet of this Registry value. Any negative side-effects (like, Windows Hello breaks and Microsoft accounts on Windows 11 logins fail) from setting this key?

You are indeed right that it only applies to S mode, but that's is because Microsoft locks the whole computer down, which is unacceptable, not because they made any architectural improvements.

It's supposed to lock the applications down until the user specified otherwise, not the user itself!

Asking for permission to use the camera should happen at device driver level, not appx level. Applications should have their file system sandboxed. Local/LocalLow/Roaming is good, but the system needs to ask if the application tries to read or write outside its own folder or those folders.

The system should ask if i am application can write files in system folders or the registry. Regedit and Explorer get a carte blanche.

Applications need to be able to specify to the OS that you should not be allowed to debug it or read its memory.

Applications should be able to specify that their window cannot be recorded, and again this happens at display server level so no applications can. They just get s as black box instead. You already have it for DRM, why can't an EXE ask for this?

And applications need to **** of the kernel, period. Especially anticheat. Popping up saying it needs to be an administration isn't enough. It needs to pop up saying "this application wants to install a driver to get full access to all memory in your system, are you okay with this?"

Both Apple and flatpak has proven this can be done with any binary. Get to work.

Actually Ishayu, that only pertains to Widows Classic Mode, which is what Microsoft calls the horribly insecure version that most people still choose to use.

Though Microsoft created the S Mode option primarily for consumers and younger users like students while initially designing Windows 10 from the Windows Core portions that would be required for all physical device platforms, few choose to use this far more secure version primarily due to the fact that some Windows developers were either lazy (or dead) and wouldn't update their existing apps for this more secure platform.

I've been using a Windows 10 in S Mode device since about a year after Microsoft released it with none of the issues you mention, but unfortunately, the creation of Windows 11 apparently made Microsoft feel that S Mode is less important, since they stopped selling it for anything other than Windows Home and don't appear to try and push the manufacturers to use it, since even their own Surface devices don't typically come with it enabled anymore.

Though the Windows 11 kernel is better protected than in the past, it's likely still possible to socially engineer a consumer into allowing malware to bypass the built-in protections, which is why I mentioned that particular caveat. However, even with Windows 10, S mode is so secure that unless I choose to exit S Mode, which since that requires Administrator access can't be done by a lower privileged account, that creates a similar situation to those other products you mentioned.

I should also mention that Microsoft has been testing 'Adminless' operation for Windows 11, but though that should remove the requirement that Windows accounts have an Administrator account by default, the unfortunate truth is that it still requires the user to make a decision, which is really the flaw as you inferred, since computers have become far too complex for all but the most technically knowledgeable to manage.

S Mode removed this issue, since it not only didn't allow full access to the operating system, but the vulnerable components it removed like most of Win32, shell access, scripting outside of the browser and the use of developer tools like RegEdit and others, left almost no access for traditional malware other than browser popups to gain a foothold. I suspect we'll eventually see something close to S Mode for all but maybe some developers, but for now we'll need to suffer through with the existing Windows 11 virtualization protections and hopefully soon the Adminless ability, which though it still allows some level of social engineering, should be enough to protect most users with even a bit of common sense.

Rob