Microsoft vs Passwords

Topic

New Reply

https://www.microsoft.com/en-us/security/blog/2024/12/12/convincing-a-billion-users-to-love-passkeys-ux-design-insights-from-microsoft-to-boost-adoption-and-security/

There’s no doubt about it: The password era is ending..

At Microsoft, we block 7,000 attacks on passwords per second—almost double from a year ago. At the same time, we’ve seen adversary-in-the-middle phishing attacks increase by 146% year over year.1 Fortunately, we’ve never had a better solution to these pervasive attacks: passkeys.

Passkeys not only offer an improved user experience by letting you sign in faster with your face, fingerprint, or PIN, but they also aren’t susceptible to the same kinds of attacks as passwords. Plus, passkeys eliminate forgotten passwords and one-time codes and reduce support calls…

2 users thanked author for this post.

F A Kramer, b

Reply | Quote

Replies

It’s still a big No Thank You from me.

3 users thanked author for this post.

SueW, Nibbled To Death By Ducks, Cybertooth

Reply | Quote

A December 24 blog post as a security warning / advice in late March 25!?
Alex, must do better.

cheers, Paul

3 users thanked author for this post.

WSbobby-p, Bob99, Microfix

Reply | Quote

Please help me understand this better as I have always used passwords (using 11 to 16 “characters”), except for logging onto my computer where I use a PIN. I use a password to access my MS account when necessary. Exactly how does a passkey differ from a password? Am I right that a PIN is stored on my computer only? Thanks to all for your responses.

Reply | Quote

A passkey uses a unique public / private key to authenticate you on the host. You store the private key locally and the host keeps the public key.
When you want to authenticate, the host sends a code calculated via the public key and your machine confirms this via the private key. You don’t need to do anything, except maybe open the private key store.
As long as nobody else has your private key, you remain secure.

A PIN is stored locally and unlocks the login. You still need the password for recovery.

cheers, Paul

Reply | Quote

Paul T wrote:

You still need the password for recovery.

Not for a Microsoft account:

How to go passwordless with your Microsoft account

Reply | Quote

Paul T wrote:

A December 24 blog post as a security warning / advice in late March 25!?

Yes. The transition is on.

* When switching to passkeys don’t keep your password as backup

Reply | Quote

It may or may not be ending “soon”.

Yubikey, for one, has had a recent security issue:

“n September 2024, security researchers from NinjaLab discovered a cryptographic flaw in Infineon chips that would allow a person to clone a Yubikey if an attacker gained physical access to it. The security vulnerability permanently affects all Yubikeys prior to firmware update 5.7. Yubico rated the issue as “moderate” citing the need for an attacker to have physical access to the key, expensive equipment, and advanced cryptographic and technical knowledge.”

Older issues also may be found at: https://en.wikipedia.org/wiki/YubiKey

Also, there are closed-source concerns:

https://en.wikipedia.org/wiki/YubiKey#YubiKey_4_closed-sourcing_concerns

IMHO, passkeys show much promise, but I’m hanging back for now. When major financial organizations join up as a majority, maybe then will be the time for me.

(Also, it would be wise to remember that the sun does not rise and set on Microsoft, and they are not infallible. They may WISH you to think so, but this site was created by a man who knew a trick or two worth that, and may the Great Grid bless him for doing that.)

Win7 Pro SP1 64-bit, Dell Latitude E6330 ("The Tank"), Intel CORE i5 "Ivy Bridge", 12GB RAM, Group "0Patch", Multiple Air-Gapped backup drives in different locations. Linux Mint Newbie
--
"The more kinks you put in the plumbing, the easier it is to stop up the pipes." -Scotty

3 users thanked author for this post.

SueW, Cybertooth, Average-Jane

Reply | Quote

Nibbled To Death By Ducks wrote:

(Also, it would be wise to remember that the sun does not rise and set on Microsoft,

Yes, it does when 90% of PC users are running Windows OS and close to that are running Office, and Microsoft can do whatever it wishes with both.

Reply | Quote

Alex5723 wrote:

Yes, it does when 90% of PC users are running Windows OS

Um, more like 71 %: https://gs.statcounter.com/os-market-share/desktop/worldwide/

…but point taken.

Interesting to note that Linux has eclipsed Mac in that arena.

Win7 Pro SP1 64-bit, Dell Latitude E6330 ("The Tank"), Intel CORE i5 "Ivy Bridge", 12GB RAM, Group "0Patch", Multiple Air-Gapped backup drives in different locations. Linux Mint Newbie
--
"The more kinks you put in the plumbing, the easier it is to stop up the pipes." -Scotty

Reply | Quote

Nibbled To Death By Ducks wrote:

Interesting to note that Linux has eclipsed Mac in that arena.

It hasn’t. MacOS (OS X) has 16% and Linux 4% there.

1 user thanked author for this post.

Nibbled To Death By Ducks

Reply | Quote

b wrote:

It hasn’t. MacOS (OS X) has 16% and Linux 4% there.

Quite right. Old eyes, very late at night. Tip O’the hat to thee. 🙂

Win7 Pro SP1 64-bit, Dell Latitude E6330 ("The Tank"), Intel CORE i5 "Ivy Bridge", 12GB RAM, Group "0Patch", Multiple Air-Gapped backup drives in different locations. Linux Mint Newbie
--
"The more kinks you put in the plumbing, the easier it is to stop up the pipes." -Scotty

1 user thanked author for this post.

b

Reply | Quote

Does creating a passkey PIN require cookies to remain on my PC? I use Firefox and have it setup to delete cookies(and site settings) on exit.

Reply | Quote

No. Passkeys and PINs don’t use cookies.

Reply | Quote