Is there a way to disable passkeys in Windows 11?

SirBlain,

If you're using Windows Hello Face, Fingerprint or PIN, you're already using FIDO 2 standard Passkeys, since that's how Microsoft gets you logged into Windows with the passkey system before you could normally use them from within the web browser.

The reason that Microsoft is forcing the use of passkeys is simple, the password is totally and utterly dead as a security feature, since it's too easy for bad actors to acquire these either via website breaches, phishing or simply getting the general public to hand them over, especially those over 50 as you mentioned, since they're generally befuddled by any authentication method regardless of how supposedly 'simple' some think it might be.

The true major problem that Microsoft has right now is the rampant loss of Microsoft Personal accounts by those of all ages, especially those using games which are a high-value target. Stopping this or even slowing it will require multiple factor authentication and the older methods of phone Text and even email are aging quickly, since they're just as prone to phishing and other more technical attack methods as email.

Passkeys, on the other hand, were designed to be phishing proof and use modern encryption techniques, while they technically require relatively little of the user himself to either set up or especially to use once they're in place.

However, you are correct that with Windows 10, the passkey support is minimal and thus relatively difficult, while even with Windows 11, the interfaces are too varied and inconsistent, simply adding to the confusion for a system that as you already noted, is completely new and unfamiliar to anyone, let alone older users.

Apple, Google, Microsoft and many others worked hard on the technology to make a highly complex system work fairly well, but it's the less technical user interface where they didn't take the time to focus their efforts on making that both simple and consistent and test with real everyday users rather than the techno-geeks who can figure it out and eventually make it work themselves.

So, you're right about the support issues, at least until they realize the true problem isn't the technology, as always it's the people, so they'll either need to properly support Windows 10 or simply drop that completely, along with working with the other major FIDO 2 members to make their interfaces at least relatively consistent across platforms and with website owners to make theirs consistent for adding and using the passkeys as well.

Even with my 50-year history using, managing and supporting computers and security, I found the Windows 10 passkey interface difficult at best and decided to stop trying to use it until I purchase a Windows 11 system next year. Since I haven't got this presently, I'm not sure how well passkeys work with Windows 11, so I can't say what precise issues remain and which are due instead to problem hardware or manufacturer implementations of Windows Hello for example, so I can't truly comment on those.

I do know there are problems though, so just like the Microsoft Authenticator app I use with ease every day, I know that some will have more problems than others using these more secure but technical tools, which unfortunately Microsoft and the other major platform developers can't afford to wait to implement until our Baby boomer generation kicks the bucket.

Rob

Hey, your attitude is showing. I'm 65 and very tech savvy. I just don't want this garbage passkey ****. I'll just log in with my password, thank you. Life is complicated enough, and I don't want Microsoft or any company hording my passwords. Got that. I consider Microsoft a security breech. I don't plan kicking the bucket any time soon. All I want to do is set up my e-mail accounts on my computer, so I can have access with my password. I don't need Microsoft turning logging into my e-mails into a shlt show.

It's not my or anyone here's passkey, since no one here works for Microsoft, we're just volunteers helping people like you with no clue.

The passkey was created by a consortium of many companies, of which Microsoft, Google and Apple are just a few, in order to get rid of the useless passwords that are one major reason so many accounts have been compromised over the last few decades.

Passkeys (Passkey Authentication)

You can choose to ignore these well-known facts, but that changes nothing, while making choices to move ahead with the modern security features as many others like me have has mean we've had simply none of these problems with losing accounts or having them breached. It's really that simple.

But go ahead and keep making bad choices, that's your right. Just don't come complain when you lose access or control of your account(s), identity or other items like money that the criminals are stealing from people every day.

Remember, it isn't Microsoft that's responsible for your account's authentication security, it's you and no one else.

Passkeys are far more secure than passwords, but they're new and require better support from your devices as well, so they won't be easy to use until you've upgraded to Windows 11, which is why I've chosen not to use them for now myself until I upgrade. I do inherently use them with Windows 10 itself though in Windows Hello, but that doesn't force me to use them for other websites, so I simply choose to ignore them other than the one I created for Amazon, but I have to use the additional TOTP code there anyway, which is why I say they're not easy [with some websites] at present.

Won't stop me from suggesting that everyone stop using passwords whenever possible though, as well as suggesting other options like the Microsoft Authenticator that I've also used for several years and works quite easily to verify both my Microsoft and other 3rd-party accounts using either the built-in password manager or TOTP codes on the authenticator itself. I use a mix of these for various sites depending on both where I am at the moment and how a particular website actually works. But then I've got roughly 50 years as a computing and security professional working for and with customers in education, business and government, so nearly anything technical is relatively easy for me, but I also understand what's actually better for most less technical users as well.

Passkeys need some polish work on the interfaces used by the vendors, but that's always true with any new technology, so eventually Microsoft and the others will work out minor bugs and annoyances like the one discussed in this thread. But that doesn't actually make them any less secure, just not yet as easy to use as they might be.

Rob

I opened this thread months ago, and to be honest in no way does the current implementation replace or bypass passwords. I have 2FA enabled on many accounts, some ask for a code from an app, and some I've setup with a physical key (Yubikey). When signing into a a website that uses the Yubikey the login experience used to be simple: I'd submit my credentials, be prompted to touch the Yubikey, and be in. Now after submitting my credentials, I am prompted with a choice of using a mobile device with a passkey or a security key. Maybe some time in the future passkeys will be widely used and replace passwords, but the fact it's a requesting a passkey as 2FA and I've not setup a passkey on any mobile device, any web browser, or anywhere within Windows makes the additional steps to select "security key", then touch the Yubikey rather annoying. I have found that disabling the computer's Bluetooth in the BIOS prevents this, but I wish there were a simpler way. If passkeys are supposed to replace passwords they should not be used as the default 2FA method in web browsers.