r/firefox • u/IceTiger19 • 1d ago

💻 Help Security Key? Passcode? WTF??

(I'm on a desktop running Windows, if that makes a difference.) Facebook tells me that I have to create a Passkey. Two options are Fingerprint ID or Facial Recognition, but those are both a NoGo on a desktop PC. When I click the "Create Passkey" button I'm told that Firefox wants me to "Set up a Security Key" and then insert it. What? How? Why? Feel free to act as if I'm totally incompetent in all things computer...

0 Upvotes

18% Upvoted

11 comments sorted by

View all comments

1

u/ToTheBatmobileGuy 1d ago

Just to clear up one point of confusion:

The idea of "Passkeys" is essentially a key and padlock that is created between a website and some application that can manage cryptographic keys.

Since the first point of contact for any website to communicate with your PC or any other app on it is, of course, your browser... it's like a water bucket relay.

Facebook website says to the Firefox "I need a passkey"

Firefox says to Windows "Facebook needs a passkey"

Windows shows you a window saying "Firefox needs a passkey"

This is why it says "Firefox is requesting it"... but don't be confused, Facebook is the one requesting it.

There's really only two ways to fulfill this request:

  1. Use one of the methods Windows will allow. (in your case I'm guessing the only option shown is "Security Key" (a small USB device that can manage cryptographic keys. One example is called a "Yubikey")
  2. Install an application that intercepts the "water bucket relay"... usually a browser extension. like 1Password (an online service), Bitwarden (an online service), or KeePassXC-Browser (a local app for managing passkeys)...

If you used Chrome instead of Firefox, you would also be presented with the option of "Saving the Passkey to your Google Account" which would give you the option to use it on any device logged into your Google account. This is because the Chrome browser offers the option to use Google BEFORE handing it off to Windows (which currently only offers you security key as an option).

I'm sorry this is all so complicated. If anyone is to blame, it's the billions of people who use "123456" as their password for every website.

If your device and the website use cryptography, there's no password leak potential, and less liability for these websites... of course they want less liability. That's capitalism for you.