Managing PIN complexity on FIDO Security Keys

Question

I have FIDO2 security keys working as part of Windows Hello for Business login to Windows 10 devices.

Whilst I can set PIN complexity as part of the user gesture PIN code, I don't seem to be able to do this when FIDO2 keys are used.

I am using the on KEY-ID ones that requires a PIN followed by a button press on the key to confirm physical presence.

Can anyone advise in this regard?

sorensonnichsen225 · Answer

Hi, we have the exactly same issue, we would like to use FIDO2 keys, but the PIN security is way to bad for our security department.Does anyone at Microsoft have an answer?

jan bakker · Answer

FIDO2 standard does not use complexity by default.So 1111 and 1234 are allowed.

sorensonnichsen225 · Answer

Hi JanYes, and that is exactly the issue.Do you know whether it is possible to apply/force complexity rules to FIDO2 devices?

jan bakker · Answer

Unfortunately not.But check out this key: https://janbakker.tech/this-might-be-the-fido2-key-for-you-authentrend-atkey-pro/You can do offline enrollment of the fingerprint, so a user is never prompted to configure a PIN. If you’re interested, please ping me on socials for a free sample.

kalimannej · Answer

Then what happens if the user’s fingerprint fails to be read for any reason such as wet hands?The FIDO2 keys generally fail over to the PIN after some number of biometric fails and they won’t know the PIN.

Forum Discussion

Managing PIN complexity on FIDO Security Keys

Share

Resources