3 ms·
Meanwhile here in 2022 I still can't use my classic blue Yubikey to secure my Microsoft account, even though it works fine with Github/Google/Fastmail/etc. I do
by andyjohnson0 4y ago
Meanwhile here in 2022 I still can't use my classic blue Yubikey to secure my Microsoft account, even though it works fine with Github/Google/Fastmail/etc. I don't want passwordless, I just want 2FA that isn't linked to my phone.
(If anyone knows why I get a "this security key can't be used" error when I try to add my Yubikeys to my msft account then I'd be interested to know. My theory is that the browser is trying to store a secret on the key but the key is immutable, but its very hard to tell.)
- judge2020 4y ago> My theory is that the browser is trying to store a secret on the key but the key is immutable, but its very hard to tell.) Pretty much. Microsoft requires Webauthn resident key[0], which allows the authenticator to authenticate passwordlessly, including without a username or email[1]. This means the authenticator has to store the relying party ID (domain/hostname) and associate it with a new key, so that it won't sign login requests to a different website. 0: https://www.w3.org/TR/webauthn-2/#enumdef-residentkeyrequirement https://www.w3.org/TR/webauthn-2/#enumdef-residentkeyrequire... 1: https://support.microsoft.com/en-us/windows/sign-in-to-your-microsoft-account-with-windows-hello-or-a-security-key-800a8c01-6b61-49f5-0660-c2159bea4d84#:~:text=How%20to%20sign%20in%20with%20a%20security%20key https://support.microsoft.com/en-us/windows/sign-in-to-your-...
- andyjohnson0 4y agoThank you for taking time to explain the problem.