Windows passwordless experience expands

sarsi I would like to suggest that you spend some time reading NIST Special Publication 800-63B which provide quite a bit of information about why eliminating passwords improves security.

Good, nice circus show for spectators then. 

sarsi  🙂

None of the discussions appear to be convincing as comprising mostly real public users like myself coming by to post - certainly not after the grand show of strange defence and your own comment here. 

I dunno why you're telling me it is an option & voluntary choice to go passwordless and password use is still available - as if that's answering my question. It is a completely irrelevant point.

I asked why Microsoft an OS software provider would suggest this when it is not a very secure option in my opinion at all? And that is something it should take into consideration because offering the option when one of them is not secure at all for its business is just nonsensical?

I pointed out my concern - that passwordless is in fact not secure at all. That is on point for this topic. Was the expectation only for users to come by with technical support type queries or simple ones that poked holes at the feature? That's your controlled ideal narrative - don't act so surprised when I point out the big elephant in the room. 

How is this any different from writing all our passwords on a piece of paper - which we all know not to do? None of you have answered that - just tried to deflect the query, using childish tactics when all of you could have just not answered and left it as a user comment.

If you can't come up with a sensible rebuttal to that - you should have just kept quiet and let my comment fade into silence instead of this circus show. 

Hi sarsi

Yes, other users mostly reply on this forum.

As far as I'm aware, Microsoft is expanding the availability of passwordless sign-in options (as a voluntary choice), so it's up to you to decide how you sign in :white_heavy_check_mark:

The ability to use passwords will continue to be available, including in Europe.

Copilot:

[1]: https://support.microsoft.com/en-us/account-billing/how-to-go-passwordless-with-your-microsoft-account-674ce301-3574-4387-a93d-916751764c43 ""
[2]: https://support.microsoft.com/en-us/windows/go-passwordless-on-your-device-5035693d-8f87-c5d5-d16c-b2f75d37bb37 ""
[3]: https://www.microsoft.com/en-us/security/blog/2021/09/15/the-passwordless-future-is-here-for-your-microsoft-account/ ""
[4]: https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-passwordless ""

Indeed, **Microsoft** is actively promoting **passwordless sign-in options** as a more secure and convenient alternative to traditional passwords. By going passwordless, users can enhance their account security while simplifying the sign-in process. Here are some key points about passwordless sign-in:

1. **What Does "Going Passwordless" Mean?**
Going passwordless refers to **removing your password** and using a passwordless method to sign in instead. These methods include:
- **Microsoft Authenticator app**: An app that generates secure codes for sign-in.
- **Windows Hello**: A biometric authentication method using facial recognition or fingerprint.
- **SMS or Email codes**: Temporary codes sent to your phone or email.
- **Physical security keys**: Hardware devices that provide an extra layer of security.

2. **Advantages of Passwordless Sign-In**:
- **Enhanced Security**: Alternative sign-in methods are more secure than traditional passwords, which can be stolen, hacked, or guessed.
- **Convenience**: Passwordless methods are faster and easier to use.

3. **How to Go Passwordless**:
- **Download and Install**: Before removing your password, download and install the **Microsoft Authenticator app** or **Outlook for Android**.
- **Sign-In Options**: Visit your **Microsoft account**, sign in, and choose **Advanced Security Options**. Under **Additional Security Options**, you'll find **Passwordless Account**. Select **Turn on**¹[1].

Remember, embracing passwordless options not only improves security but also streamlines your authentication experience! 🚀

(1) How to go passwordless with your Microsoft account. https://support.microsoft.com/en-us/account-billing/how-to-go-passwordless-with-your-microsoft-account-674ce301-3574-4387-a93d-916751764c43.
(2) Go passwordless on your device - Microsoft Support. https://support.microsoft.com/en-us/windows/go-passwordless-on-your-device-5035693d-8f87-c5d5-d16c-b2f75d37bb37.
(3) The passwordless future with Microsoft | Microsoft Security Blog. https://www.microsoft.com/en-us/security/blog/2021/09/15/the-passwordless-future-is-here-for-your-microsoft-account/.
(4) Microsoft Entra passwordless sign-in - Microsoft Entra ID. https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-passwordless.

Worthless advice from the beginning to the end - as expected from a community that insists on appearing as a public forum of discusssion by people who are least tolerant of public opinion. 

I don't think any of the people here are working for Microsoft. You are exactly who you reveal yourself to be - the ones lobbying publicly under guise of public discussion for the kind of useless features that purports to protect consumers, with a clear intent for Microsoft to adopt these ideas into its business - maybe you do this to other tech companies too, I dunno - but your goal is so that your interests, both foreign, state and commercial can get a part to play. 

You weren't even interested in defending Microsoft - you just wanted to make sure you got your last word in that passwordless is totally secure, like just repeating it will work. 

You are right that it is not just a Microsoft thing - however, since only Microsoft is the key party running this site and having these wonderful blogs about the topic as if it is a thing to celebrate, calling for comments - why would I not reply here? And my comment stands - it is a dumb thing to assume that it is higher security for Microsoft - it is a dumb thing for any corporation, but those corporations don't have a public tech community discussing this.

I'm only interested in what Microsoft may feel about it. My concern is the businesses that make the things I use have to waste their time and resources catering to regulatory authorities and various governments who won't just come right out and negotiate commercially at least openly on the public table but insists on using us end-consumers as the excuse for its numerous initiatives, treaties, symposiums, summits to discuss some grave social issue like AI, Tech intelligence, data privacy, cookies. 

Find your own excuse, stop making use of the broad term of consumers and individuals. I don't care for public intervention in my consumer choices, I don't care for your fake excuses and your numerous legal acts that birth and spawn derivatives of its own irrelevance for years down the line. 

You ran a public forum - am I the first to leave a comment that isn't complimentary of this? Then its about time someone said it. I responded precisely because I feel very strongly about this and since you opened the floor - might as well make my thoughts known to let Microsoft and others know I am an end-user who don't care for these useless features - that I believe MS is more or less getting strongarmed into introducing them so as facilitate the entry of other parties into the storyline later on. 

You have EU purporting to be worried about data privacy and introducing some Digital Act that now requires Microsoft to have a popup window reminding users whether they want to sign-on with same credentials? Anyone thinking straight can see how redundant this is - EU is worried about the rights of its European dwellers not being able to figure out sign-on credentials on their own, despite having a computer and surfing online themselves and therefore its grand result of its concern is basically a pop up window to nag them about this? If they could decide this for themselves with just your reminder, they could have done so without. EU's participation is unwanted - nobody asked for it - it just wanted in.

The blatantly irrelevant issues raised on behalf of consumers and frankly, the hint of bribery and corruption behind such industry practices are disgusting to see, especially when you dare to parade this publicly as if it is a perfectly logical & good thing.

The last people I would bother with would be those very members of the alliance you mention because they are the origin of this - why would I care to persuade to change their mind - they are free to super alliance fido dido, that's not my concern.

You do what you do - if you want an open feud on your own fake forum, let's go then. I don't care what EU or UN or your individual countries get to profit from this, whether this is business norm, industry practice or even if nobody, not even Microsoft is particularly inconvenienced by these sort of business hurdles - that's for you lot to sleep at night.

If I don't like it, I'm gonna say it - and you are the one running a public form so if you can't take real public opinion, you should not open it to the public but you can't - precisely because the public opinion is the one you actually have to win so that EU, other governments and the likes of its kind doesn't look like its butting its nose into things where nobody asked for it to be.

sarsi Hi again,

If Microsoft doesn't answer your questions, I suggest you to contact all of the members of the FIDO2 alliance. Going passwordless, is not just a Microsoft thing.

{link removed by admin}

Have a wonderful day.

I think I was right to say this Microsoft community is a strange one and perhaps not officially blessed by them. I'm apparently sparring with someone who isn't even the author of the article who clearly refuses to answer any of my points directly and just tries to school me by saying I don't know the topic.

Your link emphasizes the exact same weak links I pointed out - your only selling point is that the paper is now so much safer cuz it's kept somewhere on the system and I'm saying that is a dumb thing to assume. 

The last i checked, the system has always been the one to fail first on a significant level - be it a hack, leak, theft and regularly - your seasonal NSA debacle where someone will whistleblow them into some scandalous misdeed that throws American tech/intel into the world limelight for scrutiny and almost predictably, a EU, UN call for oversight. 

What's your point again? You have nothing for me. I can sit here quietly and wait for Microsoft to reply. 

@pbirster Are there any articles out there on passwordless that isn't actually written and circulated by the parties that have business interests in advocating for passwordless? I don't think so. 

Is that the standard for determining what makes sense? By the literature out there? You almost sound like an invisible third hand coming out to deflect on their behalf. 

If it's that obvious and I'm that clueless - then Microsoft should be able to deflect the points I've made based on common sense about my security concerns and my curiosity for their decisions in this area really easily - don't get in the way if you're not going to clarify even at least part of anything I said, that's just rude. I was very specific in my post and it was directed to Microsoft. 

sarsi I think you need some thorough readings on how passwordless is much more secure than a password in any situation.