passkey across multiple devices without linking devices

Question

I have about 50 devices I log into on a weekly basis; some devices have shared accounts (eg domain accounts) many do not (eg android, mac, windows).

I will never link any of these devices together; that is a MASSIVE security risk (eg going through Customs where there are no civil rights protections).

I dont always have my phone with me; and I know people that do not have and will never have a smart phone.

So can someone explain to me how to manage and share passkeys between multiple devices without linking devices nor using any sort of "authenticator" smartphone app?

Lets start with a simple scenario: I have two windows computers with no association between them and no smartphone; I want to login into "myaccount.microsoft.com" from both of them... so do I create passkeys on both windows computers or do I use a USB stick or some online service to share a passkey between both computers?

Answer 1

that doesnt answer my question. I did read the article btw.

how do i share passkey between devices without a physical device to move them on?

also there is no way that a 4 digit pin is more secure than a 20 character password.

I most certainly am not using finger print or biometrics to secure anything; those create even bigger security issues.

one example is a person was pranked to reset their picture, which basically locked them out of their phone unless they do something embarassing.

also, lots of people do not have computers that support biometrics.

also, the "passkey" recognition feature doesnt work right.

in order to reply I had to reauthenticate because this website pulled up the wrong passkey account. it then gave me a bunch of WRONG suggestions as how to log in, because those accounts I had just logged out of.

so, back to original question: how to manage and share passkeys between multiple devices without linking devices nor using any sort of "authenticator" smartphone app?

FYI: I ask this because I have been using OpenIddict to implement web app authentication in my applications. So, as a developer, I need to understand how this "passkey" thing doesnt work for users, so I build work arounds for yet another microsoft failure.

Answer 2

You're welcome.

Although this site is called Microsoft Community, those of us who volunteer to assist in this forum are not employees of Microsoft and we have no direct lines of communication with them or their customer service team.

I understand your frustration and I too would like to see Microsoft provide more effective and efficient support to all consumers. I agree that Microsoft's approach to rollouts with new enhancements, features and security developments for their products/services can sometimes be overwhelming and confusing for the general user community.

Answer 3

thank you for trying to answer the question; you can only work with what you have been given.

the point I am trying to make is that Microsoft is pushing passkeys onto the general user community in a very rushed manner; with basically no way to opt out. Now, there might be a way for "professionals" such as yourself to override this "enforced" optin; but the general user community wont have access to those options.

While the INTENT of passkeys is to close off yet another man-in-the-middle hack of multi-factor-authentication; the implementation leaves a lot of the user community in the lurch. As usual, not all use cases have been resolved. This means people will be locked out of services, which will require more manual intervention, which will mean more security breaches like the MGM/Caesar breaches a few years back.

Answer 4

You may want to start by reading this article which should help you understand how this all works.
 
Passkeys Authentication Across Platforms - How Passkeys Registration and Authentication Work Across Devices and Platforms
 
Passkeys rely on public-key cryptography (keypair concept: a private key and a public key) in combination with Windows Hello biometrics (fingerprint or facial recognition) or PIN to sign-in. Passkeys are based on Fast IDentity Online (FIDO) standards. A passkey is invisible, virtual and purposely hidden from access inside the TPM (Trusted Platform Module). The TPM is isolated from the main processor and functions as a vault (a lockbox for keys) so in the event of malware attack or breach, sensitive user data remains secure. Devices that incorporate a TPM can create cryptographic keys and encrypt them, so that the keys can only be decrypted by the TPM.
 
A security key (hardware token), sometimes called a FIDO2 key, is a passwordless authentication method available as a sign-in option in Windows that is used with a unique PIN or fingerprint for authentication instead of a username and password. Security keys are physical devices like USB drives, NFC devices (smartphone, tablet, gaming console, access card) or Bluetooths which must be unlocked with a PIN or fingerprint before it can be used to sign in to Windows, apps, websites and work or school accounts. Security keys adhere to Fast IDentity Online (FIDO) standards, ensuring cross-platform compatibility and support across various websites and applications. Even if someone steals your security key, they will not be able to sign in without your PIN or fingerprint.

• Key Differences: Passkey vs. Security Key
• Passkeys vs. Security Keys: How Do They Work?
• What are some potential Drawbacks of Passkeys?

Answer 5

I don't know the answer to your specific question since I never tried to do you what you're asking. I was just ensuring you were aware of the information I provided and you have indicated that you do. There is likely few if any here with knowledge or expertise required to answer more technical issues like you have raised. If no one else replies, you may want to ask at Microsoft Q&A Questions.