Is there a way to disable passkeys in Windows 11?

Even with Bluetooth turned off you’ll get the popup. You need to disable Bluetooth in the BIOS to avoid this. If windows has any awareness of the system being capable of Bluetooth it’ll ask for a passkey.

Actually Jefronty, that's the true problem you've identified, while I may have implied otherwise while discussing the problems relating to passwords and how the passkey solves most of these.

While for now the password itself must obviously remain available in many cases as one method for account recovery with 2FA implementations, it's really the implementations themselves that are creating the problems, which though I inferred that I didn't state as clearly as I should have.

Microsoft is the only one I've seen who actually at least suppresses the use of the password as a primary method when you have multiple alternate methods of verification available, and even allows you to disable it for at least authentication.

We both actually agree that the implementations are where the problems truly lie, with the redesigned interface for FIDO 2 operation your post discusses one of the first noticeable changes that affected a relatively small number of users. However, that's always the bigger problem when it comes to changing something as fundamental as authentication, since it's the user touchpoint that makes any change difficult, whether it's well implemented or not.

For example, every article I've seen about the passkey indicates it's inherently a 2-Factor method itself, since it requires both something you possess like your smartphone that contains the private key and creates the passkey, as well as something you are like biometrics or know like your PIN. As discussed in the following article, that also means there's really no need with a passkey to use either the legacy password nor an added 2FA step, since that's replaced more securely by the encrypted passkey, public key and challenge sequence.

Passkeys vs Two-Factor Authentication (2FA): What's the Difference?

At the same time, physical implementations for passkey use require biometric or PIN verification of your presence, as well as the verification this device is nearby to the device being authenticated via something like Bluetooth, exactly as you pointed out in your last post.

So, with all of this stated, then why did a company like Amazon allow me to perform the initial authentication step using either a password or passkey, but then still require that I complete a redundant 2-Factor step using a far less secure TOTP Text message when the passkey I provided has already performed this same 2-Factor authentication in both a more secure and verified way?

I understand why people with a security key like YubiKey are irritated that this now takes added steps to use, but also that the list of items now available to authenticate requires some form of display, at least until it can be polished and redesigned to allow for a more adaptive set of display abilities.

In reality though, from what I just read the YubiKey was really just another TOTP implementation, which though it may now allow some form of direct entry of the verification codes, is still technically susceptible to many of the same issues. If that's the case, then I suspect that Microsoft and in fact most of the FIDO Alliance members see these as a temporary solution that passkeys are expected to eventually replace.

Based on recent security and attack trends, as well as the fact that Microsoft requires, and Apple, Google and other major smartphone manufacturers now build into all of their own devices the hardware necessary to support passkeys, it won't take long for any companies already using TOTP or similar advanced security technologies to add and/or switch to the FIDO 2 standards.

I assume a few will still be using passwords a decade from now, but anyone already supporting the better methods is eventually likely to drop those like TOTP that inherently include the same potential issues of phishing or capture that passwords do, regardless of whether some physical devices used to provide them may handle them a bit more securely.

I really don't expect it to take more than 2 or 3 years for nearly any truly important websites to at least add passkey support and in fact expect that those like financial institutions, government, and most retail will be requiring them, or at least some form of well-secured 2FA (e.g. not most TOTP code options) such as an authenticator app by that time.

IOW, if you think through the above without any preference in mind, you'll quickly see that the passkeys and FIDO 2 so completely obliterate any of the other currently available options, that it's the only one that makes sense for most organizations to put future effort into implementing, so in reality any TOTP or other less secure legacy option is really already dead in terms of future growth. That's why I'm so certain that passkeys will become the standard so quickly, because the core requirements in hardware and software development by major organizations like Apple, Google, Microsoft and many others have already either ben completed or are at least quite far along.

Rob

Excuse me sir how can i disable my password of my pc?

The browser I use most often is Brave and I checked the settings. Windows Hello is disabled already. I've updated my post to include a screenshot of the prompt I'm asking about.

Hi Jefronty,

I'm Sumit, here to answer your query at the Microsoft Community.

There is a prompt for disabling Windows Hello Authentication in Chrome, but not for Edge as I see.

Do you use Chrome or Edge to sign in?

Please keep us posted.