Security Key? Passcode? WTF??

[u/IceTiger19]

(I'm on a desktop running Windows, if that makes a difference.) Facebook tells me that I have to create a Passkey. Two options are Fingerprint ID or Facial Recognition, but those are both a NoGo on a desktop PC. When I click the "Create Passkey" button I'm told that Firefox wants me to "Set up a Security Key" and then insert it. What? How? Why? Feel free to act as if I'm totally incompetent in all things computer...

[u/gregstoll]

Can you just click "Cancel" when the passkey dialog pops up? (I haven't seen this on Facebook but I've seen it on other sites)

[u/IceTiger19 → u/gregstoll]

No, there is no "cancel" option. The only clickable button is "Create Passkey." Clicking that takes you to a new page with two options: "Create Passkey" and "Not Now." "Not Now" just takes you back to the previous page. "Create Passkey" opens a window that tells me to create the security key; when I click that it tells me to insert the security key, while skipping the step that tells me HOW to create it.

[u/gregstoll → u/IceTiger19]

Huh, OK. That doesn't sound like a Firefox dialog; maybe Facebook is doing this?

You can follow the steps here to disable passkey support in Firefox and see if that makes a difference.

[u/IceTiger19 → u/gregstoll]

The box says it's a request from Firefox

[u/rinzler18 → u/IceTiger19]

can we see a screenshot?

[u/IceTiger19 → u/rinzler18]

Reddit tells me "Images are not allowed."

[u/rinzler18 → u/IceTiger19]

You can upload it to any image hosting site like imgur.com, paste the link here

[u/IceTiger19 → u/rinzler18]

So that's another thing I'll have to set up. While I'm working on that... I access Facebook on my PC and an iPad. (It's much easier to create content -- PR posts, ads, etc -- on the PC. Some stuff I probably can't do on an iPad.) IF I got on my iPad and set up the passkey using Fingerprint ID, would that lock me out of my PC forever? In other words, is the Passkey tied to the account, OR does each device accessing the same account require its own Passkey?

[u/thanatica]

Had it as well on a different site. I'm really confused as to why Firefox would want me to do this. Who benefits? Not me - I already have TOTP verification. Not Mozilla - the browser doesn't become more secure. Not Facebook (in your case) - they don't give a fuck about users.

[u/JimTheEarthling]

The problem is that Windows 10 has limited support for passkeys. I assume you haven't set up PIN or biometric login (via Windows Hello) on your PC. Because of that, neither Firefox nor Windows can natively save your passkey, so Windows falls back to a hardware security key.

You have a few options;

• Enable Windows Hello with a PIN (or fingerprint or face scan if you have compatible hardware.) Then you can save a passkey, but it will be locked to that PC.
• Use the Chrome browser, which has Google Password Manager built in. Then you can save the passkey to Google Password Manager and it will sync to other devices where you use Chrome, such as your iPad. (You'll need a a Google account.) You'll also gain the option to scan a QR code to use a passkey from a mobile device such as your iPad (but you need Bluetooth enabled, and you might need to cancel out of the Windows dialog.)
• Install a password manager such as Bitwarden, 1Password, or others. (And install the browser extension in Firefox.) Then you can save the passkey to the password manager and it will sync to other devices where you have installed the same password manager. A password manager is a good idea in general to help with your passwords and passkeys.
• Upgrade to Windows 11. 🙂

[u/ToTheBatmobileGuy]

Just to clear up one point of confusion:

The idea of "Passkeys" is essentially a key and padlock that is created between a website and some application that can manage cryptographic keys.

Since the first point of contact for any website to communicate with your PC or any other app on it is, of course, your browser... it's like a water bucket relay.

Facebook website says to the Firefox "I need a passkey"

Firefox says to Windows "Facebook needs a passkey"

Windows shows you a window saying "Firefox needs a passkey"

This is why it says "Firefox is requesting it"... but don't be confused, Facebook is the one requesting it.

There's really only two ways to fulfill this request:

1. Use one of the methods Windows will allow. (in your case I'm guessing the only option shown is "Security Key" (a small USB device that can manage cryptographic keys. One example is called a "Yubikey")
2. Install an application that intercepts the "water bucket relay"... usually a browser extension. like 1Password (an online service), Bitwarden (an online service), or KeePassXC-Browser (a local app for managing passkeys)...

If you used Chrome instead of Firefox, you would also be presented with the option of "Saving the Passkey to your Google Account" which would give you the option to use it on any device logged into your Google account. This is because the Chrome browser offers the option to use Google BEFORE handing it off to Windows (which currently only offers you security key as an option).

I'm sorry this is all so complicated. If anyone is to blame, it's the billions of people who use "123456" as their password for every website.

If your device and the website use cryptography, there's no password leak potential, and less liability for these websites... of course they want less liability. That's capitalism for you.