Is there a way to disable passkeys in Windows 11?

Actually Jefronty, that's the true problem you've identified, while I may have implied otherwise while discussing the problems relating to passwords and how the passkey solves most of these.

While for now the password itself must obviously remain available in many cases as one method for account recovery with 2FA implementations, it's really the implementations themselves that are creating the problems, which though I inferred that I didn't state as clearly as I should have.

Microsoft is the only one I've seen who actually at least suppresses the use of the password as a primary method when you have multiple alternate methods of verification available, and even allows you to disable it for at least authentication.

We both actually agree that the implementations are where the problems truly lie, with the redesigned interface for FIDO 2 operation your post discusses one of the first noticeable changes that affected a relatively small number of users. However, that's always the bigger problem when it comes to changing something as fundamental as authentication, since it's the user touchpoint that makes any change difficult, whether it's well implemented or not.

For example, every article I've seen about the passkey indicates it's inherently a 2-Factor method itself, since it requires both something you possess like your smartphone that contains the private key and creates the passkey, as well as something you are like biometrics or know like your PIN. As discussed in the following article, that also means there's really no need with a passkey to use either the legacy password nor an added 2FA step, since that's replaced more securely by the encrypted passkey, public key and challenge sequence.

Passkeys vs Two-Factor Authentication (2FA): What's the Difference?

At the same time, physical implementations for passkey use require biometric or PIN verification of your presence, as well as the verification this device is nearby to the device being authenticated via something like Bluetooth, exactly as you pointed out in your last post.

So, with all of this stated, then why did a company like Amazon allow me to perform the initial authentication step using either a password or passkey, but then still require that I complete a redundant 2-Factor step using a far less secure TOTP Text message when the passkey I provided has already performed this same 2-Factor authentication in both a more secure and verified way?

I understand why people with a security key like YubiKey are irritated that this now takes added steps to use, but also that the list of items now available to authenticate requires some form of display, at least until it can be polished and redesigned to allow for a more adaptive set of display abilities.

In reality though, from what I just read the YubiKey was really just another TOTP implementation, which though it may now allow some form of direct entry of the verification codes, is still technically susceptible to many of the same issues. If that's the case, then I suspect that Microsoft and in fact most of the FIDO Alliance members see these as a temporary solution that passkeys are expected to eventually replace.

Based on recent security and attack trends, as well as the fact that Microsoft requires, and Apple, Google and other major smartphone manufacturers now build into all of their own devices the hardware necessary to support passkeys, it won't take long for any companies already using TOTP or similar advanced security technologies to add and/or switch to the FIDO 2 standards.

I assume a few will still be using passwords a decade from now, but anyone already supporting the better methods is eventually likely to drop those like TOTP that inherently include the same potential issues of phishing or capture that passwords do, regardless of whether some physical devices used to provide them may handle them a bit more securely.

I really don't expect it to take more than 2 or 3 years for nearly any truly important websites to at least add passkey support and in fact expect that those like financial institutions, government, and most retail will be requiring them, or at least some form of well-secured 2FA (e.g. not most TOTP code options) such as an authenticator app by that time.

IOW, if you think through the above without any preference in mind, you'll quickly see that the passkeys and FIDO 2 so completely obliterate any of the other currently available options, that it's the only one that makes sense for most organizations to put future effort into implementing, so in reality any TOTP or other less secure legacy option is really already dead in terms of future growth. That's why I'm so certain that passkeys will become the standard so quickly, because the core requirements in hardware and software development by major organizations like Apple, Google, Microsoft and many others have already either ben completed or are at least quite far along.

Rob

"YubiKey was really just another TOTP implementation". Wrong!

YubiKey, like many other hardware tokens, implements many different Industry standards, like PKCS#11 (aka PIV, as standardized by US Gov for strong authentication), OATH, OpenPGP, U2F/FIDO2, etc.

The latter, when properly configured, may also mandate PIN (aka "User Verification") and touch (aka "Presence Verification").

I "X" out of it, but I hate it.

It is an annoyance and an added unnecessary feature. It doesn't take the place of the 2FA process. I would not want that.
I may choose to give someone the passkey to use my computer, but not want them to purchase from my Amazon account, for instance.

I already use passkeys with a 3rd party password manager. The awful Windows 11 passkey popup interferes with it and there is currently no way to transfer passkeys from a password manager to another location (e.g. Windows Hello). If anyone knows how to disable the popup please reply. Thanks.

I already use passkeys with a 3rd party password manager. The awful Windows 11 passkey popup interferes with it and there is currently no way to transfer passkeys from a password manager to another location (e.g. Windows Hello). If anyone knows how to disable the popup please reply. Thanks.

Jon Lobatto,

The simple way I've heard to suppress the Windows passkey dialog box is to disable Bluetooth, since that's required to establish the phone's proximity to the device in order for a passkey to be accessed from an external device like a smartphone which supports this, so only the locally stored passkeys within Windows 11 can effectively be used which remove the need for the dialog.

I haven't heard whether this works from either end of the connection, but I'd think it should, so if you don't typically use Bluetooth with your PC then disabling that might work, while it's often required for phone accessories. If it can be quickly toggled on or off, then it might still work even if it's only occasionally needed for some other purpose or when you leave the house with the phone for example.

I don't recall if any other options have been discovered, but I'd think they'd be far more disruptive than even disabling Bluetooth if they do.

Rob