Transcript
Paul Thurrott (0:00)
Coming up next on Hands on Windows, we're going to take a look at some new passkey features for Windows 1125H2.
Leo Laporte (0:09)
Podcasts you love from people you trust. This is Twit.
Paul Thurrott (0:19)
Hello, everybody, and welcome back to Hands on Windows. I'm Paul Thurat, and this week I'm going to do the first of two episodes in a row about passkeys. Pass keys are a modern replacement for passwords. They are confusing. So the easiest way to think about this is they're basically a form of Multi Factor Authentication, or MFA or Two Factor Authentication. Some people call it Two Step Authentication. But they're more secure and more convenient than passwords. They can't be stolen, so they're phishing resistant. If some site is hacked and your password is leaked, doesn't matter if you need to have a passkey to get into that account. But the confusion, I think, is based on a lot of things. Passwords are insecure, but they're basic, right? We understand what it is. We have an account of some kind, usually an email address for an online account, and you have a password and it's some set of numbers and letters or whatever. It seems easy, but they're super, super insecure. So passkeys are confusing because they're basically pairs of cryptographic keys. That one exists on your device or up in the cloud, one exists somewhere else, and you don't own both of them. There's no way to put them together. They can't be stolen. Basically, it feels vague, but it's not really that bad. In fact, once you kind of get in the swing of this, you'll wonder why you aren't doing this everywhere. In fact, you should be doing it everywhere. So in this episode, what I want to do is focus just on the passkey functionality that's built into Windows 11, right? And so sometime in the past year, we would have done some episode about this because back in 2324 H2, Microsoft added basic passkey functionality to Windows, which you can see by going into the Settings app and then accounts, and then you'll see this passkey section, right? And so at the time, this was pretty much it. If you log in with a Microsoft account or a Microsoft work or school account, you get this pass key right here, which is associated with that account. So in my case, this is a Microsoft account. There's no actually says delete. Oh, but you can't, because it will say you cannot do it. Right? Because this thing is required for you to sign into this PC. If you add Other pass keys to the system, they will be listed here. We'll look at that in a moment. And you can delete those. That's about all you can do with those things. But the problem with this feature is that these passkeys are not portable. They're locked onto this one computer. So if you have another computer, you have a phone, you have an iPad or a tablet or whatever, you would have to create a new passkey on each one of those devices. Right. Microsoft calls this a device bound passkey. Okay. But if that doesn't bother you, you may want to do that. That's fine. So I'm going to run a browser that I don't usually use, which is getting excited to use a passkey immediately. So let me just close that and it will go to the Google Accounts website where it will actually before I. No, it's fine. This is fine. I just want to make sure I wasn't using some other form of passkey management. I got to be careful. This is why I'm using Chrome. So Chrome is configured right now not to do anything for passkey. So this will give you kind of the native experience. So once you're inside this Google account website, you can go into security and sign in, go down to passkeys and there will be. It wants a passkey for me to sign in, of course. So this is actually the, in many ways, till now, I would say the most common experience for passkeys. Not the security key part, but rather you have a phone and that phone has some password manager or passkey manager on it. And I can scan a QR code with my phone to log in. So I'm actually going to do that right now. So you're going to see there's a QR code. So I bring up the phone, the camera, I took a picture like an idiot because I'm old. But now I will scan it and it will connect and then I say, yes, use the passkey and it lets me get into this more secure area of the Google Accounts website. Right. So now I want to create a new passkey, but this casci is one I want to save on this device specifically. So when I click this, what I get is this Windows security dialog. It's got the name of the passkey in the account and it does say this will be saved to your Windows device, which is what I want in this case. So this is going to create a device bound passkey that only exists on this one computer. So I click this, I will have to do some form of Windows hello Authentication. Look at the camera and get through that little tedious. But we've created the pass key, okay. So I could look at that on this page, but I think the more important thing to do is go back and look at it in Windows so you can see that it was created on the computer itself and there it is. So again, there's not a lot you can do here. I can delete it. Okay. And the idea here is that going forward, if you were going to use this kind of passkey, which I don't necessarily recommend because it's locked to this one computer, you could use a different browser. Maybe you got logged out, you log into some other Google service. Whatever it is, it would just pass that thing through to you. We're going to look at that kind of experience in the next episode. But for now, I'm just going to get rid of that thing because I don't want it and I'm not going to use that kind of passkey. But it's not portable. So. To address the portability problem in 25H2, the latest version of Windows 11, Microsoft added two related features that make pass keys more portable. Native integration with the Microsoft Password Manager. That's part of Microsoft Edge, but it works on other devices as well through Edge, actually, and also third party password manager integration. So instead of using this native experience, I could use a third party app, which in this case would be like 1Password or Bitwarden. Those are the two that are compatible today and then in the future there'll be more. So we're going to take a look at both of those. But first, here's a quick message.