Is there a way to disable passkeys in Windows 11?

"YubiKey was really just another TOTP implementation". Wrong!

YubiKey, like many other hardware tokens, implements many different Industry standards, like PKCS#11 (aka PIV, as standardized by US Gov for strong authentication), OATH, OpenPGP, U2F/FIDO2, etc.

The latter, when properly configured, may also mandate PIN (aka "User Verification") and touch (aka "Presence Verification").

It's not my or anyone here's passkey, since no one here works for Microsoft, we're just volunteers helping people like you with no clue.

The passkey was created by a consortium of many companies, of which Microsoft, Google and Apple are just a few, in order to get rid of the useless passwords that are one major reason so many accounts have been compromised over the last few decades.

Passkeys (Passkey Authentication)

You can choose to ignore these well-known facts, but that changes nothing, while making choices to move ahead with the modern security features as many others like me have has mean we've had simply none of these problems with losing accounts or having them breached. It's really that simple.

But go ahead and keep making bad choices, that's your right. Just don't come complain when you lose access or control of your account(s), identity or other items like money that the criminals are stealing from people every day.

Remember, it isn't Microsoft that's responsible for your account's authentication security, it's you and no one else.

Passkeys are far more secure than passwords, but they're new and require better support from your devices as well, so they won't be easy to use until you've upgraded to Windows 11, which is why I've chosen not to use them for now myself until I upgrade. I do inherently use them with Windows 10 itself though in Windows Hello, but that doesn't force me to use them for other websites, so I simply choose to ignore them other than the one I created for Amazon, but I have to use the additional TOTP code there anyway, which is why I say they're not easy [with some websites] at present.

Won't stop me from suggesting that everyone stop using passwords whenever possible though, as well as suggesting other options like the Microsoft Authenticator that I've also used for several years and works quite easily to verify both my Microsoft and other 3rd-party accounts using either the built-in password manager or TOTP codes on the authenticator itself. I use a mix of these for various sites depending on both where I am at the moment and how a particular website actually works. But then I've got roughly 50 years as a computing and security professional working for and with customers in education, business and government, so nearly anything technical is relatively easy for me, but I also understand what's actually better for most less technical users as well.

Passkeys need some polish work on the interfaces used by the vendors, but that's always true with any new technology, so eventually Microsoft and the others will work out minor bugs and annoyances like the one discussed in this thread. But that doesn't actually make them any less secure, just not yet as easy to use as they might be.

Rob

SirBlain,

If you're using Windows Hello Face, Fingerprint or PIN, you're already using FIDO 2 standard Passkeys, since that's how Microsoft gets you logged into Windows with the passkey system before you could normally use them from within the web browser.

The reason that Microsoft is forcing the use of passkeys is simple, the password is totally and utterly dead as a security feature, since it's too easy for bad actors to acquire these either via website breaches, phishing or simply getting the general public to hand them over, especially those over 50 as you mentioned, since they're generally befuddled by any authentication method regardless of how supposedly 'simple' some think it might be.

The true major problem that Microsoft has right now is the rampant loss of Microsoft Personal accounts by those of all ages, especially those using games which are a high-value target. Stopping this or even slowing it will require multiple factor authentication and the older methods of phone Text and even email are aging quickly, since they're just as prone to phishing and other more technical attack methods as email.

Passkeys, on the other hand, were designed to be phishing proof and use modern encryption techniques, while they technically require relatively little of the user himself to either set up or especially to use once they're in place.

However, you are correct that with Windows 10, the passkey support is minimal and thus relatively difficult, while even with Windows 11, the interfaces are too varied and inconsistent, simply adding to the confusion for a system that as you already noted, is completely new and unfamiliar to anyone, let alone older users.

Apple, Google, Microsoft and many others worked hard on the technology to make a highly complex system work fairly well, but it's the less technical user interface where they didn't take the time to focus their efforts on making that both simple and consistent and test with real everyday users rather than the techno-geeks who can figure it out and eventually make it work themselves.

So, you're right about the support issues, at least until they realize the true problem isn't the technology, as always it's the people, so they'll either need to properly support Windows 10 or simply drop that completely, along with working with the other major FIDO 2 members to make their interfaces at least relatively consistent across platforms and with website owners to make theirs consistent for adding and using the passkeys as well.

Even with my 50-year history using, managing and supporting computers and security, I found the Windows 10 passkey interface difficult at best and decided to stop trying to use it until I purchase a Windows 11 system next year. Since I haven't got this presently, I'm not sure how well passkeys work with Windows 11, so I can't say what precise issues remain and which are due instead to problem hardware or manufacturer implementations of Windows Hello for example, so I can't truly comment on those.

I do know there are problems though, so just like the Microsoft Authenticator app I use with ease every day, I know that some will have more problems than others using these more secure but technical tools, which unfortunately Microsoft and the other major platform developers can't afford to wait to implement until our Baby boomer generation kicks the bucket.

Rob

Thank you. I pretty much always have bluetooth turned off in settings so I gave this a try and disabled it in the BIOS and now I'm able to login simply and quickly again.