12 ms·

Next month, saved passwords will no longer be in Microsoft’s Authenticator app

186 points by ColinWright 1y ago

simonw 1y ago
I'm confused. Is this a Windows-exclusive thing? As an iPhone and Mac user is there anything I need to do? There is an app in the iPhone App Store called "Microsoft Authenticator" - is that what this story is about or is there a Windows feature with a confusingly identical name?
- munchler 1y ago
  Yes, they're talking about a mobile app used for two-factor authentication. It doesn't run on Windows (or Mac). If you don't have this app on your phone, you don't need to worry about it.
- abawany 1y ago
  IME some MS shops enforce use of it for 2fa to access company resources like vpn and etc. - for eg, the only reason this app exists on my phone is so I can log into my employer's vpn.
  - reginald78 1y ago
    Are you sure you need the Microsoft one? After reading the giant support document at my employer I eventually figured out that any TOTP supporting app would work but most of the documentation made it sound like Microsoft was required anyway.
    - abawany 1y ago
      it seems to be a push notification where the ms authenticator doesn't generate a code until I first log into the vpn using exchange creds but tbf, I didn't look hard enough for alternatives so you are probably right that I could use any totp app.
    - JZerf 1y ago
      This depends on how the organization configures things. My company used to allow TOTP so many TOTP apps could be used instead of Microsoft Authenticator but my company disabled that a while ago. Now the only authenticator app my company allows is Microsoft Authenticator using push notifications (see https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-authenticator-app#passwordless-sign-in-via-notifications https://learn.microsoft.com/en-us/entra/identity/authenticat... ). Consider yourself lucky if your employer allows you to use any TOTP app you want instead of forcing you to use Microsoft Authenticator.
bob_theslob646 1y ago
> July 2025: You won't be able to use the autofill password function. > August 2025: You'll no longer be able to use saved passwords There has to be some sort of cost benefits analysis for this as this will certainly piss a ton of people off especially the tech illiterate. Maybe passkeys are extremely simple but saved passwords being disallowed is a huge pain point.
- xp84 1y ago
  Nobody tech illiterate was using MS Authenticator as their default autofill provider as it’s not the default autofill mechanism on iOS or Android. The passwords have always been stored in your Microsoft account. Anyone who has their passwords there can just install Edge on their device and enable it as the autofill provider (no, that doesn’t require you to browse with Edge, just to log into it). This whole article is silly, as there is zero change to your ability to save passwords in your MS account or to autofill them on mobile.
withinrafael 1y ago
The simpler version is that Microsoft Authenticator--a mobile app that provides 2FA--is discontinuing its password autofill feature and the passwords stored/used with that will be wiped in August unless action is taken, as has been communicated for a while now. More information: https://support.microsoft.com/en-us/account-billing/changes-to-microsoft-authenticator-autofill-09fd75df-dc04-4477-9619-811510805ab6 https://support.microsoft.com/en-us/account-billing/changes-...
- TiredOfLife 1y ago
  "Your saved passwords (but not your generated password history) and addresses are securely synced to your Microsoft account, and you can continue to access them and enjoy seamless autofill functionality with Microsoft Edge"
sedatk 1y ago
This is very bold because passkeys haven't been the smoothest ride so far. There are many inconsistencies in implementations among platforms. For example, many websites use passkeys as an alternative sign-in option, and let you keep your password login. So, you remain susceptible to phishing despite having a passkey on your account. Recovery flows are inconsistent too. I applaud Microsoft because a big player had to go all-in into passwordless authentication. I'm sure it won't be painless, but it might push others to adopt the approach eventually.
- grahameb 1y ago
  There's still a dearth of support in commonly used open source backend frameworks, too – and, at least after looking a bit the other day, I couldn't find much in the way of documentation on the standard flows. I was hindered a little in searching by SEO spam from various companies offering APIs to deal with users/passkeys for me as a service.
  - aniviacat 1y ago
    Bypassing SEO spam is the core use case of LLMs (with search function) for me. It's so nice to just get a (relatively) concise answer immediately.
joeblubaugh 1y ago
And people complain about Apple being paternalistic. If you’re already saving passwords in an app, you’re being more secure than most users. A forced move to passkeys seems nuts when not all systems support them yet. I’m also still concerned that passkeys seems more likely to fail the average user when they break or lose a device, compared to a decent password.
- burnt-resistor 1y ago
  Both are technofeudal corporations and hostile to users' rights. Microsoft is just rapidly getting even worse lately.
- Groxx 1y ago
  Also next to impossible to write down to give to someone else. This (or by phone) is how I've transferred: all family accounts, all small community accounts, some business accounts, many friend-shared accounts, and it's also how some people ensure accounts can be accessed if they die. It's not a small problem.
- jrockway 1y ago
  Yeah, I think people will lose their passkeys a lot. I think companies are happy to provide another service ("passkey syncing") that you will pay for for life. Back In The Day you could be a freeloader by remembering your passwords like a nerd. No longer. The loophole is closed! That said, passwords are actually so bad that anything would be an improvement over them. While a stealable passkey vault sync'd to your malware-infested Windows laptop is not ideal for security, it's sure better than typing your bank password into your favorite forum because you don't understand that website administrators can see your password when you type it on their site. (Not to mention phishing.)
  - jeroenhd 1y ago
    Apple, Google, and Microsoft already do passkey sync for free. They don't do exports, though. However, there are various third party solutions for synching passkeys that aren't tied to your computer manufacturer. I don't think passkeys are going to replace passwords any time soon, and I don't think freeloaders are even part of the equation here. You can share a passkey through Bitwarden just as easily as you can share a password. Freeloaders already need to jump through hoops to share passwords and even then they're getting off easy; if streaming companies actually cared about catching freeloaders, they could stop the practice all together. What they're doing now is just signalling them that you're not supposed to and adding very minor annoyances to the mix.
djrj477dhsnv 1y ago
If I can't export the private key to my own backup solution, I don't want it.
- Analemma_ 1y ago
  [flagged]
  - ChromaticPanic 1y ago
    If that means I lose access to my accounts if my device dies on me, then hard pass.
  - CamperBob2 1y ago
    Sounds like the sort of thing that will lock me out for any of a dozen different reasons.
    - subarctic 1y ago
      Ya really what you want is your passwords saved in an encrypted vault that you can copy from device to device for backup. If passkeys are really one per device and you have have 100 passkeys from 100 different services, and moving to a new device requires accessing each of those 100 services to create a new passkey for the new device, that sounds terrible
      - WarOnPrivacy 1y ago
        > If passkeys are really one per device and you have have 100 passkeys from 100 different services, and moving to a new device requires accessing each of those 100 services .... I'm typing this on my Firefox remote app. Everything is cached in it. It runs in a VM at home. I suppose I am simulating having just one device.
        Brian_K_White 1y ago
        Everyone else: don't do this
School-Cotton 1y ago
Absolutely bonkers if true. The #2 thing you don’t want a password manager to do (after, of course, leaking your passwords) is deleting your passwords! Hopefully this will entice people to switch to 1Password, but I’m pessimistic — it will most likely just convince people not to use password managers at all.
- LeoPanthera 1y ago
  I hope they don't switch to 1Password, I switched away from it, after their new Electron app repeatedly failed to autofill passwords in Safari - a basic function.
  - Quarrel 1y ago
    While not quite switching to 1Password, the latest Win 11 build includes: > We have partnered with 1Password to bring users a seamless plugin passkey provider integration in Windows 11. after other details at least it does go to: > If you are a credential manager developer, we invite you to integrate with Windows 11 to support customers in their passkey journey. To find out more about implementation detail, go to https://aka.ms/3P-Plugin-API https://aka.ms/3P-Plugin-API. The full info: https://blogs.windows.com/windows-insider/2025/06/27/announcing-windows-11-insider-preview-build-26200-5670-dev-channel/ https://blogs.windows.com/windows-insider/2025/06/27/announc...
- Brian_K_White 1y ago
  keepass ffs not 1password
- FinnKuhn 1y ago
  As I understood it from the announcement in the App itself the password will still be available but through the Edge App instead. No idea who thought of this bad idea. Now I gotta move them all to Apple passwords or something else.
WarOnPrivacy 1y ago
I occasionally run into small biz employees running the mandated MS Authenticator (biz O365) on their personal devices. This makes me sad. I'm trialing Winauth for some remote-only users. So far I'm happy with having the authenticator on Windows desktop. ref: https://github.com/winauth/winauth https://github.com/winauth/winauth
- anotherhue 1y ago
  ehh... for just one well behaved app I think it's tolerable. It's about where I draw the line though.
  - WarOnPrivacy 1y ago
    Most every bit of online exchange and O365 (+the ever-changing, ever-growing stack of MS policy/admin/security panels) is overkill for 10-20 users who need mail, Outlook, Word, Excel (no substitutions). It's a massive hydra and it's most dependable output is onerous requirements. And the more of those we heap upon light duty users, the more reasonable it becomes to circumvent them. In this scenario Winauth is how we placate the unreasonable overlord.
- adastra22 1y ago
  What is sad about that?
  - WarOnPrivacy 1y ago
    >> employees running corp MS Authenticator on their personal devices makes me sad. > What is sad about that? Why does it make me sad? That's a good question. Insufficient respect for employees' personal domain. Non-optimal IT defaults. - It sets up a scenario where the employee's personal device is co-opted without their full, meaningful consent. - It places work assets in a personal device. - It introduces a scenario where a critical function takes place outside of direct view and control of IT. Lastly and speculatively, it places Microsoft software in their device and Microsoft can't be trusted to keep it's hands to itself when it has an opportunity to be creepy, grabby or slimy. Examples: Slimy: Injects Bing links into phone's context menu when Outlook for Android app is installed. Grabby: History of sharing personal data with 700+ partners. Creepy: Relentlessly pushes CoPilot like horny drunk uncle pushes sex innuendos. refs: MS Authenticator Sandbox analysis: https://www.virustotal.com/gui/file/c165ea4f2c399f474f068087944052116aeb5df054577aa0a529fdfaa0805b33/details https://www.virustotal.com/gui/file/c165ea4f2c399f474f068087... https://kagi.com/search?q=How+is+Microsoft+like+a+creepy+uncle+when+it+relentlessly+pushes+copilot+on+users%3F&r=us&sh=eWJ_LBFqSpMhizM4uPhOaQ https://kagi.com/search?q=How+is+Microsoft+like+a+creepy+unc...
0xbadcafebee 1y ago
If you need a new password manager to keep 2FA codes as well as passwords, Bitwarden is open source (AGPL-3.0/GPL-3.0), and you can self-host the server if you want. Only solution that won't eventually become crappified by a business that doesn't care about you.
_carbyau_ 1y ago
I would have thought password management will be quite important for a long while yet. Is MS simply dodging the responsibility? Maybe so they can't be leaned on by government?
cwillu 1y ago
And more importantly (for them), it's much harder to share a passkey than it is to share a password. “Why GNU su does not support the `wheel‘ group Sometimes a few of the users try to hold total power over all the rest. For example, in 1984, a few users at the MIT AI lab decided to seize power by changing the operator password on the Twenex system and keeping it secret from everyone else. (I was able to thwart this coup and give power back to the users by patching the kernel, but I wouldn’t know how to do that in Unix.) However, occasionally the rulers do tell someone. Under the usual su mechanism, once someone learns the root password who sympathizes with the ordinary users, he or she can tell the rest. The “wheel group” feature would make this impossible, and thus cement the power of the rulers. I’m on the side of the masses, not that of the rulers. If you are used to supporting the bosses and sysadmins in whatever they do, you might find this idea strange at first.” https://www.meisterplanet.com/journal/2004/05/09/richard-stallman-su-and-the-wheel-group/ https://www.meisterplanet.com/journal/2004/05/09/richard-sta...
execat 1y ago
What's their end game here? What is Microsoft gaining from their push to passkeys? They knew this was going to piss off a lot of people, but they went ahead with it anyway. That makes me believe there's something else at play. My experience with passkeys has been worse that my Bitwarden password auto complete, so needless to stay I'm sticking with my regular passwords on my Bitwarden (I know Bitwarden has Passkeys support. I don't want to use it)
- hakfoo 1y ago
  I suspect it's another step in the push to make the mobile device the centre of digital identity. (Yeah, it might support some standalone key devices, but nobody's giving Joe Sixpack a Yubikey) The one with far more data gathering capability and generally less robust ability for the end user to assert control over it, and which is generally tied to a service contract that in many countries requires identity verification.
  - tacticus 1y ago
    That would require all the microsoft auth platforms to allow you to use yubikeys or similar instead of default forcing you in to ms authenticator only
    - jdmoreira 1y ago
      Microsoft authenticator supports YubiKeys
- ocdtrekkie 1y ago
  So in business Microsoft cloud land, not using Microsoft Authenticator specifically is basically impossible. You have to shut it off four different ways even if you have an alternative solution already configured. I think centralizing control is absolutely the core play for them.
- RataNova 1y ago
  Feels like they're betting big on being seen as a leader in "passwordless" security
foobarbecue 1y ago
This will be delayed. Anyone want to bet me?
xp84 1y ago
This is missing an important piece of information. If I open Authenticator on iOS I see this message front and center: > Autofill via Authenticator ends in July 2025 You can export your saved info (passwords only) from Authenticator until Autofill ends. Access your passwords and addresses via Microsoft Edge at any time. To keep autofilling your info, turn on Edge or other provider. (Learn more) not sure the full Android feature set, but MS is moving their iOS autofill provider to the Edge app, which doesn’t mean I have to use Edge to browse, just changes which app hosts the passwords. I can still fill them using the native mechanism for any password manager to provide passwords to any password field. Microsoft is not forcing anybody to adopt passkeys as far as I can tell. Although overall people should because passwords are quite frankly a broken idea. Almost as broken as the idiotic janky “we just emailed/texted you a code” bullshit that most sites do now instead of TOTP.
- TiredOfLife 1y ago
  Same with Mozilla they also moved passwords to Firefox from standalone app. The reason for missing information is that this is blogspam an older version of AI slop.
TiredOfLife 1y ago
They just moved the saved password functionality to their browser. Just like Mozilla did.
- hulitu 1y ago
  > They just moved the saved password functionality to their browser. Just like Mozilla did. Wonderful. The Remote Code Executor now takes care of your pass.... too. What can go wrong ? One thing browsers are recognized for, it is their security record. /s
unethical_ban 1y ago
So what is the recovery mechanism for the passkey? And they don't expect me to have a different passkey per device, right? Otherwise I still need a password every time I login to a new device. And so I'll still need a password/passkey manager that stores that.
- charcircuit 1y ago
  >So what is the recovery mechanism for the passkey? Similar to a password there isn't a way to recover it if you forget it. >And they don't expect me to have a different passkey per device, right? You can have it show a QR code that you can scan with phone, using your phone as a passkey.
  - geocar 1y ago
    > Similar to a password there isn't a way to recover it if you forget it. But dissimilar to a password in that you aren't ever expected to remember it, can't write it down, and in other ways. > You can have it show a QR code that you can scan with phone, using your phone as a passkey. I can't keep my phone in my safe and still use my phone.
    - charcircuit 1y ago
      >I can't keep my phone in my safe and still use my phone. Okay, so don't put it in a safe. The key is stored securely in your phone.
      - mrweasel 1y ago
        > The key is stored securely in your phone. No it's not, what if I drop my phone in the ocean. Sure in terms of encryption, secure storage and so on, it's securely stored. It's just no physically secured. That's what concerns people. What happens if I lose my devices? What happens if I need to access an account which has been secured by a passkey, but I don't have any of my other devices, what do I do then?
RHSeeger 1y ago
I have yet to see a compelling argument for passkeys that is strong enough to overpower it's negatives. - I want to be able to share passwords for accounts with my family (some, but not all of them) - I want to be able to load up my login information from whatever device I am currently working on; my phone, my home computer, my work computer, my wife's phone, etc - I don't want to risk my phone breaking and losing access to all my accounts Something like 1Password or Bitwarden fits all of that perfectly.
- Avicebron 1y ago
  > see a compelling argument for passkeys It's tied to vendor lock in. Which increases the ability of companies who develop certain technologies for the masses to increase the friction of interacting with things outside of the ecosystem. The argument is that if a user is unable to use an alternative, by hook or crook they will pay increasingly high subscriptions to access the services provided by that ecosystem. This increases a number on a spreadsheet, the only true compelling argument one could say
  - re 1y ago
    > It's tied to vendor lock in If you're referring to the inability to transfer passkeys across systems, that should be improving soon. https://blog.1password.com/fido-alliance-import-export-passkeys-draft-specs/ https://blog.1password.com/fido-alliance-import-export-passk... https://arstechnica.com/security/2025/06/apple-previews-new-import-export-feature-to-make-passkeys-more-interoperable/ https://arstechnica.com/security/2025/06/apple-previews-new-...
    - ls612 1y ago
      As long as the passkey spec includes remote snitching (attestation) your keepass open source alternative will exist only because big tech allows it, and it will end when big tech demands it. The entire import/export standard is a red herring.
      - rantallion 1y ago
hsbauauvhabzb 1y ago
I do not support - under any conditions - an application which DESTROYS existing secrets. You can stop supporting new ones, but as soon as you destroy old ones YOU are a vulnerability, Microsoft. How can I ever trust you to not delete secrets in future?
- TiredOfLife 1y ago
  It doesn't destroy secrets. https://support.microsoft.com/en-us/account-billing/changes-to-microsoft-authenticator-autofill-09fd75df-dc04-4477-9619-811510805ab6 https://support.microsoft.com/en-us/account-billing/changes-...
theginger 1y ago
Is this anything to do with them taking passwords without consent? I rarely use windows, and when I do one of the first things I do is switch from edge to chrome. I think I set up edge and used it once to see what it was actually like, but I was pretty careful about the data syncing / sharing settings. I have the Microsoft authenticator app on my phone, I was pretty careful about the privacy settings on that too, but it's been through a couple of phone upgrades. Somehow all of my passwords were making their way into Microsoft authenticator, so I must have missed something somewhere. I can only imagine how many millions of people must have had their passwords unintentionally slurped by Microsoft if they have been that aggressive with it.
deleted 1y ago
[deleted]
raphael_l 1y ago
Slightly off topic, but the Microsoft Authenticator app on iOS is - in my opinion - the probably worst designed app by a large corporation. Nothing in there works the way you’d expect it to work. And my absolutely favorite thing was when it itself came in the way of seeing the 2FA code for a modal entry and you had the option on the screen to hide the modal for 10 seconds in order to remember the number underneath… See screenshot here: https://ibb.co/5Wh05rsd https://ibb.co/5Wh05rsd
- strbean 1y ago
  Truly amazing that without the "I can't see the number" option you probably could have seen the number.
  - raphael_l 1y ago
    That’s true, but only for my screen size. A smaller device wouldn’t.
- jorvi 1y ago
  Are you on an iPhone Mini? Just like the 5S / SE before it, corporations just sort of stopped testing that screen size, which leads to dumb UI gaffes like that. Another classic is button or menu text getting truncated. Spotify had that problem on the SE too.
  - raphael_l 1y ago
    This was in February of last year according to the screenshot, my device was an iPhone 11 - not a small one, but rather very much standard screen size!
- cycomanic 1y ago
  Don't worry it's not better on Android either. Since my work has switched to office365 it's just been hassle after hassle. The outlook app on my phone (and I can't use any other method because it has been disabled), frequently looses authentication and I stop getting notifications about calendar events, emails ..., missed several meetings and important emails because of this. When trying to login on my desktop/laptop I get told to confirm using either outlook, MS authentication app. Guess what often I have been locked out on those as well, so now I have to go through the dance of logging in using a sms code instead. It's sometimes even worse, even on mobile I get told to confirm from my authentication app/outlook, where I'm just trying to log in. Authentication request often only come through to my phone on the 3rd of 4th try. So now logging in to check my email suddenly takes 2 min, because I'm trying to get the popup in the app, it doesn't appear, I need to cancel the request, restart ...
ars 1y ago
I don't have a fingerprint scanner on my computer, nor facial recognition. I do not want any kind of password that relies on my phone, because phones break and can get lost. So basically this forces me to change from a password to a PIN and this is supposed to be more secure?
- jeroenhd 1y ago
  No, this will force you to either install Microsoft Edge on your phone or switch to one of the many other password managers that do offer autofill on iOS. If you weren't synchronising your passwords through the Microsoft authenticator app, you won't be affected at all. If you were, Microsoft has decided to be annoying and make you install their browser to get password autofill support back. Microsoft prefers synchronising passkeys between devices because passkeys are immune to credential stuffing attacks, but you don't have to do what Microsoft wants.
- hulitu 1y ago
  > So basically this forces me to change from a password to a PIN and this is supposed to be more secure? Yes. I used an alphanumeric pin: my password. The main malware entry point is the web browser.
- johnisgood 1y ago
  I use KeePassDX and it works quite well. I save the keyfile in a couple of places. Not sure what it has to do with Microsoft, however, but then again, I would never use Microsoft's Authenticator.
hokkos 1y ago
I never ever succeeded in making a passkey log in after generating one.
dontTREATonme 1y ago
My first experience with passkeys was eBay. They implemented them 3-4 years ago, and my password manager, Dashlane picked up on it. They offered to save it and I wouldn’t have to enter a username or password. Great, seemed to work. Until I needed to login on another device and then Dashlane saved that passkey too, but each passkey was tied to the specific device… only it wasn’t clear when I logged in which passkey I should choose, and chose the wrong one and it doesn’t work. After having like 6 different passkeys for eBay I gave up. Now I always decline to use passkeys. They don’t work, idk who uses them but as a fairly tech savvy user, without a very complex setup (chrome, with Dashlane installed) if it’s not working for me it’s probably just not working. I’ll also add. I don’t have a good mental model for what a passkey is or how it works. And again, like most users if I don’t really understand what’s going on I’m just not gonna bother with it. For all the complexity that it takes to implement secure login with a username and password, most of it is hidden from the user, with passkeys it feels like they’re shoving all the complexity front and center, but not explaining any of it.
- ashdksnndck 1y ago
  Nowadays I use the passkeys with my password manager and everything works across multiple devices. I’ve never been presented with a list of passkeys to select from.
  - sydbarrett74 1y ago
    I’ll second this. A combo of KeePassXC (desktop), KeePassium (Apple), and KeePass2Android plus manually synching my .kbdx file makes the passkey experience relatively smooth for me.
    - dale_huevo 1y ago
      So you need three different applications and manually moving around files to achieve a "relatively smooth" experience? I don't think this is the endorsement you think it is.
      - 1y ago
RataNova 1y ago
Killing autofill and saved passwords in Authenticator is a bold move, especially considering how many non-technical users rely on that feature without even knowing what a passkey is
jakub_g 1y ago
One thing unclear: While I understand they want to transparently replace passwords with passkeys for websites that support it, what happens with passwords for websites that don't support passkeys? Also, if someone sleeps over this, they will just lose their passwords to random websites and have to go through account recovery flows?
- jeroenhd 1y ago
  If you install Edge, you can keep using the synced passwords. They're only disabling password autofill for their authenticator app, they're not throwing your passwords away. The app has been warning about this for a while now. This might catch someone out of guard if they only use the app once a year for something bureaucratic, but I doubt a credential like that will be stored in Microsoft's authenticator app.
rambambram 1y ago
Wherever I work, IT departments expect me to install MS Authenticator on my own smartphone. To authenticate myself to MS so they can authenticate me to the organisation that already has seen my passport and my driver's license. No thanks...
jonathanlydall 1y ago
For those who may not have read the article fully, Microsoft's existing traditional password management on mobile devices is not becoming unavailable, but is being moved from the Authenticator App to Microsoft Edge. I had this warning show up in the iOS Authenticator app like last week or something and it guides you through changing your iOS settings to instead use Edge as a password manager. As Edge is my browser of choice on my Windows PC and I already had it installed on iOS, this was a very minor inconvenience for me. It's worth mentioning that even though I almost exclusively use Safari as a web browser on my iOS device, when filling in passwords on websites it seamlessly allows you to use any iOS configured password manager including Edge. It's definitely a little weird that you now require Edge to also be installed for essentially the same functionally and Microsoft might be doing it to try push people to install Edge.
- sydbarrett74 1y ago
  I think you’re right about Edge being the real play here. MS wants to increase Edge adoption and dig at Google. Passkeys are a pretext.
- m463 1y ago
  also I've noticed with multiple forms of authentication the slack will be taken up by microsoft having your phone number.
- reval 1y ago
  This makes me feel a little better about this change. However, there are bound to be weird Edge cases. Edge allows multiple profiles, are all always available to store passwords? Can your IT department block the use of personal profiles if you’re logged into a company profile?
wkat4242 1y ago
What a dick move. I don't want to use edge, it's a terrible browser. And most sites don't support passkeys. I'm glad I don't use Microsoft crap but use everything self hosted so I can decide for myself what I want.
ano-ther 1y ago
It’s also annoying that MS requires a personal account for backing up the Authenticator data to iCloud to ”provide an additional layer of encryption“. That description makes little sense, and at least they could honor my paid business subscription (and back it up to there if they don’t trust iCloud).
meindnoch 1y ago
Microsoft continues its was against its own users.
jeroenhd 1y ago
What a terrible article. The text suggests that Microsoft wants to force you to use passkeys, followed by an attempt by the writer to convince you to use passkeys, when the actual news is "you need to install another app to get autofill from Microsoft's password sync service". You can just install Edge. From what I can tell, you don't even need to browse using Edge to use passwords. If you don't use Microsoft Authenticator, nothing changes. If you do, probably because IT makes you, you've already seen the warnings about this.
karel-3d 1y ago
Apple keeps pushing PassKeys to me. Also, Apple requires at least one AppleID password, that I need to keep entering at random intervals - usually when I update any device, but sometimes randomly when I buy stuff on App Store. Also I still need a Mac user password, which is a different password, of course.
- latexr 1y ago
  > Also I still need a Mac user password, which is a different password, of course. Why “of course”? No one is stopping you from using the same password there. Also, you can optionally turn on the option to be able to reset your Mac’s password with your Apple Account password.
  - karel-3d 1y ago
    I mean that it's a different concept; a different thing. You can set it as the same thing but need to remember keeping it same. (There is also an Apple Recovery password, but that's for encrypted recovery, a different thing, but that is very hidden and experimental.)
cycomanic 1y ago
What I don't understand with the push for passkeys, is that for years we have been told we need at least two factors for secure authentication, something we have and something we know. Now with passkeys, it seems we are just throwing all those arguments overboard and are saying 1 factor (something you have, e.g. hardware device) is enough. I've not read anywhere a good argument why. Sometimes people have been arguing that the passkey should still be locked into e.g. another password manager with password, but that doesn't seem to be the case with most implementations, am I missing something?
- kemotep 1y ago
  Passkeys are quite disappointing in practice. I feel like they were described as ssh keys for website logins but they seem to be half-baked. Accessibility concerns and vendor lock-in are certainly an issue. Definitely stick to keeping passwords and passkeys in a password manager for portability. KeepassXC and Bitwarden (which can be self-hosted) work best for this in my opinion.
  - al_borland 1y ago
    Why would I keep them separate? What does this achieve?
    - anonymars 1y ago
      Are you replying to the right post or did parent edit?
      - al_borland 1y ago
        I’m now not sure if there was an edit or if my brain inserted a word. When I replied, I thought I read that they were saying to keep passwords and passkeys in separate password managers, but maybe I’m just going crazy.
    - kemotep 1y ago
      Keep what separate?
creatonez 1y ago
Yes, Microsoft is the worst company ever. ...But this article headline is insanely misleading by not mentioning it's being migrated to Edge. To the point where I'd call it a smear crafted for maximum clickbait shock value. Nothing is being wiped, it's just being moved to a different app. Sure, there's good reasons to not like that app (it's the Internet Explorer sequel after all), but the story here is not as extreme as implied.
joshstrange 1y ago
I am skeptical of passkeys. Not of the technology itself exactly, but people’s implementation of it. Username/password is much easier to grok (for developers and users) and while it absolutely has downsides, as a user, I can fully protect myself with username/password (unique password per site). Passkeys might allow for fewer _user_ footguns but I worry there more _developer_ footguns. Also as a “power user”, I don’t want to deal with passkeys when I’m trying to automate something or scape my own data out of a website. It’s just another complication and I worry that anything edge-case-y (even approved methods) will break or have complications if you use passkeys (think app-specific-passwords when 2FA rolled out for gmail access). Because of this I consistently decline passkey usage until such a time that I feel it’s better understood by the people implementing it.
ReptileMan 1y ago
Microsoft authenticator is such a travesty. Proprietary 2FA, no standards, can't export the seed.
yodon 1y ago
I recently replaced my iPhone with a newer model. All the Microsoft accounts in my Microsoft Authenticator broke when I restored onto the new iPhone. None of the non-Microsoft accounts stored in the same Authenticator app broke. No, Microsoft, I don't trust you to manage passkeys for me.
- nashashmi 1y ago
  Was your Authenticator backed up in iCloud?
  - yodon 1y ago
    > Was your Authenticator backed up in iCloud? Yes
mzajc 1y ago
Besides other inconveniences mentioned here, I'm very concerned about "passkey provider attestation" (see: walled garden). This was already brought up as a threat against KeepassXC because their implementation allowed "too much" user choice: [1]. Does anyone know if this kind of anti-user attestation has been or can be deployed? I really can't understand why anyone would promote passkeys in good faith if that's the case. [1]: https://github.com/keepassxreboot/keepassxc/issues/10407#issuecomment-1994673954 https://github.com/keepassxreboot/keepassxc/issues/10407#iss...
1970-01-01 1y ago
All because of advertising. Strong passwords + not tying the account to an email address is the most phishing resistant thing one can do, however nobody is allowed to do this because they need your email address for advertising. Stop welding my identity to an email address and the entire problem becomes an order of magnitude easier to manage and maintain.
blindriver 1y ago
What happens if you lose your phone? I can’t find any explanation of passkeys that explains how I recover if my phone dies, gets stolen etc.
deleted 1y ago
[deleted]
mathiaspoint 1y ago
Wait so are people just going to lose their passwords? That seems like terrible PR for a company that want to shift to services. If you rug people just for marketing reasons like that why should anyone trust you with important business processes. This won't be something people can just ignore, if I lost my (homebrew for exactly this reason) password manager it would probably cause close to 40 hours of time cleaning up the mess spread out of months. We're talking about millions, potentially even billions of dollars worth of destruction depending on how many people were stupid enough (yes that's the appropriate word although it's more obvious now) to trust Microsoft to maintain their secrets for them.
burnt-resistor 1y ago
Who trusts Microsoft with their passwords, seriously? And passkeys are even worse because they're user hostile, dev hostile, and stuck in a walled-garden. Passwords and 2FA (TOTP or passkeys or something else, with a recovery code mechanism), not just passkeys, or GTFO.
rekabis 1y ago
This is a very smh facepalm bridgepinch sigh moment, where Microsoft could have taken the high road and gently educated users by restricting insecure passwords instead of blocking their use entirely. A simple bit complexity algorithm like what KeePass uses could determine a threshold beneath which restrictions on adding/using passwords could start to bite. I only use their app for Microsoft resources, as the 2FA and other security features are stronger through the app than through other 2FA channels. The 2FA itself, for example, is plumped up from 6 to 8 digits. And there is a challenge/response code you can use as well. But still, IMO this was a massive missed opportunity.

186 points by ColinWright 1y ago

I'm confused. Is this a Windows-exclusive thing? As an iPhone and Mac user is there anything I need to do? There is an app in the iPhone App Store called "Microsoft Authenticator" - is that what this story is about or is there a Windows feature with a confusingly identical name?

munchler 1y ago
Yes, they're talking about a mobile app used for two-factor authentication. It doesn't run on Windows (or Mac). If you don't have this app on your phone, you don't need to worry about it.
abawany 1y ago
IME some MS shops enforce use of it for 2fa to access company resources like vpn and etc. - for eg, the only reason this app exists on my phone is so I can log into my employer's vpn.
- reginald78 1y ago
  Are you sure you need the Microsoft one? After reading the giant support document at my employer I eventually figured out that any TOTP supporting app would work but most of the documentation made it sound like Microsoft was required anyway.
  - abawany 1y ago
    it seems to be a push notification where the ms authenticator doesn't generate a code until I first log into the vpn using exchange creds but tbf, I didn't look hard enough for alternatives so you are probably right that I could use any totp app.
  - JZerf 1y ago
    This depends on how the organization configures things. My company used to allow TOTP so many TOTP apps could be used instead of Microsoft Authenticator but my company disabled that a while ago. Now the only authenticator app my company allows is Microsoft Authenticator using push notifications (see https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-authenticator-app#passwordless-sign-in-via-notifications https://learn.microsoft.com/en-us/entra/identity/authenticat... ). Consider yourself lucky if your employer allows you to use any TOTP app you want instead of forcing you to use Microsoft Authenticator.

bob_theslob646 1y ago

> July 2025: You won't be able to use the autofill password function. > August 2025: You'll no longer be able to use saved passwords There has to be some sort of cost benefits analysis for this as this will certainly piss a ton of people off especially the tech illiterate. Maybe passkeys are extremely simple but saved passwords being disallowed is a huge pain point.

xp84 1y ago
Nobody tech illiterate was using MS Authenticator as their default autofill provider as it’s not the default autofill mechanism on iOS or Android. The passwords have always been stored in your Microsoft account. Anyone who has their passwords there can just install Edge on their device and enable it as the autofill provider (no, that doesn’t require you to browse with Edge, just to log into it). This whole article is silly, as there is zero change to your ability to save passwords in your MS account or to autofill them on mobile.

withinrafael 1y ago

The simpler version is that Microsoft Authenticator--a mobile app that provides 2FA--is discontinuing its password autofill feature and the passwords stored/used with that will be wiped in August unless action is taken, as has been communicated for a while now. More information: https://support.microsoft.com/en-us/account-billing/changes-to-microsoft-authenticator-autofill-09fd75df-dc04-4477-9619-811510805ab6 https://support.microsoft.com/en-us/account-billing/changes-...

TiredOfLife 1y ago
"Your saved passwords (but not your generated password history) and addresses are securely synced to your Microsoft account, and you can continue to access them and enjoy seamless autofill functionality with Microsoft Edge"

sedatk 1y ago

This is very bold because passkeys haven't been the smoothest ride so far. There are many inconsistencies in implementations among platforms. For example, many websites use passkeys as an alternative sign-in option, and let you keep your password login. So, you remain susceptible to phishing despite having a passkey on your account. Recovery flows are inconsistent too. I applaud Microsoft because a big player had to go all-in into passwordless authentication. I'm sure it won't be painless, but it might push others to adopt the approach eventually.

grahameb 1y ago
There's still a dearth of support in commonly used open source backend frameworks, too – and, at least after looking a bit the other day, I couldn't find much in the way of documentation on the standard flows. I was hindered a little in searching by SEO spam from various companies offering APIs to deal with users/passkeys for me as a service.
- aniviacat 1y ago
  Bypassing SEO spam is the core use case of LLMs (with search function) for me. It's so nice to just get a (relatively) concise answer immediately.

joeblubaugh 1y ago

And people complain about Apple being paternalistic. If you’re already saving passwords in an app, you’re being more secure than most users. A forced move to passkeys seems nuts when not all systems support them yet. I’m also still concerned that passkeys seems more likely to fail the average user when they break or lose a device, compared to a decent password.

burnt-resistor 1y ago
Both are technofeudal corporations and hostile to users' rights. Microsoft is just rapidly getting even worse lately.
Groxx 1y ago
Also next to impossible to write down to give to someone else. This (or by phone) is how I've transferred: all family accounts, all small community accounts, some business accounts, many friend-shared accounts, and it's also how some people ensure accounts can be accessed if they die. It's not a small problem.
jrockway 1y ago
Yeah, I think people will lose their passkeys a lot. I think companies are happy to provide another service ("passkey syncing") that you will pay for for life. Back In The Day you could be a freeloader by remembering your passwords like a nerd. No longer. The loophole is closed! That said, passwords are actually so bad that anything would be an improvement over them. While a stealable passkey vault sync'd to your malware-infested Windows laptop is not ideal for security, it's sure better than typing your bank password into your favorite forum because you don't understand that website administrators can see your password when you type it on their site. (Not to mention phishing.)
- jeroenhd 1y ago
  Apple, Google, and Microsoft already do passkey sync for free. They don't do exports, though. However, there are various third party solutions for synching passkeys that aren't tied to your computer manufacturer. I don't think passkeys are going to replace passwords any time soon, and I don't think freeloaders are even part of the equation here. You can share a passkey through Bitwarden just as easily as you can share a password. Freeloaders already need to jump through hoops to share passwords and even then they're getting off easy; if streaming companies actually cared about catching freeloaders, they could stop the practice all together. What they're doing now is just signalling them that you're not supposed to and adding very minor annoyances to the mix.

djrj477dhsnv 1y ago

If I can't export the private key to my own backup solution, I don't want it.

Analemma_ 1y ago
[flagged]
- ChromaticPanic 1y ago
  If that means I lose access to my accounts if my device dies on me, then hard pass.
- CamperBob2 1y ago
  Sounds like the sort of thing that will lock me out for any of a dozen different reasons.
  - subarctic 1y ago
    Ya really what you want is your passwords saved in an encrypted vault that you can copy from device to device for backup. If passkeys are really one per device and you have have 100 passkeys from 100 different services, and moving to a new device requires accessing each of those 100 services to create a new passkey for the new device, that sounds terrible
    - WarOnPrivacy 1y ago
      > If passkeys are really one per device and you have have 100 passkeys from 100 different services, and moving to a new device requires accessing each of those 100 services .... I'm typing this on my Firefox remote app. Everything is cached in it. It runs in a VM at home. I suppose I am simulating having just one device.
      - Brian_K_White 1y ago
        Everyone else: don't do this

School-Cotton 1y ago

Absolutely bonkers if true. The #2 thing you don’t want a password manager to do (after, of course, leaking your passwords) is deleting your passwords! Hopefully this will entice people to switch to 1Password, but I’m pessimistic — it will most likely just convince people not to use password managers at all.

LeoPanthera 1y ago
I hope they don't switch to 1Password, I switched away from it, after their new Electron app repeatedly failed to autofill passwords in Safari - a basic function.
- Quarrel 1y ago
  While not quite switching to 1Password, the latest Win 11 build includes: > We have partnered with 1Password to bring users a seamless plugin passkey provider integration in Windows 11. after other details at least it does go to: > If you are a credential manager developer, we invite you to integrate with Windows 11 to support customers in their passkey journey. To find out more about implementation detail, go to https://aka.ms/3P-Plugin-API https://aka.ms/3P-Plugin-API. The full info: https://blogs.windows.com/windows-insider/2025/06/27/announcing-windows-11-insider-preview-build-26200-5670-dev-channel/ https://blogs.windows.com/windows-insider/2025/06/27/announc...
Brian_K_White 1y ago
keepass ffs not 1password
FinnKuhn 1y ago
As I understood it from the announcement in the App itself the password will still be available but through the Edge App instead. No idea who thought of this bad idea. Now I gotta move them all to Apple passwords or something else.

WarOnPrivacy 1y ago

I occasionally run into small biz employees running the mandated MS Authenticator (biz O365) on their personal devices. This makes me sad. I'm trialing Winauth for some remote-only users. So far I'm happy with having the authenticator on Windows desktop. ref: https://github.com/winauth/winauth https://github.com/winauth/winauth

anotherhue 1y ago
ehh... for just one well behaved app I think it's tolerable. It's about where I draw the line though.
- WarOnPrivacy 1y ago
  Most every bit of online exchange and O365 (+the ever-changing, ever-growing stack of MS policy/admin/security panels) is overkill for 10-20 users who need mail, Outlook, Word, Excel (no substitutions). It's a massive hydra and it's most dependable output is onerous requirements. And the more of those we heap upon light duty users, the more reasonable it becomes to circumvent them. In this scenario Winauth is how we placate the unreasonable overlord.
adastra22 1y ago
What is sad about that?
- WarOnPrivacy 1y ago
  >> employees running corp MS Authenticator on their personal devices makes me sad. > What is sad about that? Why does it make me sad? That's a good question. Insufficient respect for employees' personal domain. Non-optimal IT defaults. - It sets up a scenario where the employee's personal device is co-opted without their full, meaningful consent. - It places work assets in a personal device. - It introduces a scenario where a critical function takes place outside of direct view and control of IT. Lastly and speculatively, it places Microsoft software in their device and Microsoft can't be trusted to keep it's hands to itself when it has an opportunity to be creepy, grabby or slimy. Examples: Slimy: Injects Bing links into phone's context menu when Outlook for Android app is installed. Grabby: History of sharing personal data with 700+ partners. Creepy: Relentlessly pushes CoPilot like horny drunk uncle pushes sex innuendos. refs: MS Authenticator Sandbox analysis: https://www.virustotal.com/gui/file/c165ea4f2c399f474f068087944052116aeb5df054577aa0a529fdfaa0805b33/details https://www.virustotal.com/gui/file/c165ea4f2c399f474f068087... https://kagi.com/search?q=How+is+Microsoft+like+a+creepy+uncle+when+it+relentlessly+pushes+copilot+on+users%3F&r=us&sh=eWJ_LBFqSpMhizM4uPhOaQ https://kagi.com/search?q=How+is+Microsoft+like+a+creepy+unc...

0xbadcafebee 1y ago

If you need a new password manager to keep 2FA codes as well as passwords, Bitwarden is open source (AGPL-3.0/GPL-3.0), and you can self-host the server if you want. Only solution that won't eventually become crappified by a business that doesn't care about you.

_carbyau_ 1y ago

I would have thought password management will be quite important for a long while yet. Is MS simply dodging the responsibility? Maybe so they can't be leaned on by government?

cwillu 1y ago

And more importantly (for them), it's much harder to share a passkey than it is to share a password. “Why GNU su does not support the `wheel‘ group Sometimes a few of the users try to hold total power over all the rest. For example, in 1984, a few users at the MIT AI lab decided to seize power by changing the operator password on the Twenex system and keeping it secret from everyone else. (I was able to thwart this coup and give power back to the users by patching the kernel, but I wouldn’t know how to do that in Unix.) However, occasionally the rulers do tell someone. Under the usual su mechanism, once someone learns the root password who sympathizes with the ordinary users, he or she can tell the rest. The “wheel group” feature would make this impossible, and thus cement the power of the rulers. I’m on the side of the masses, not that of the rulers. If you are used to supporting the bosses and sysadmins in whatever they do, you might find this idea strange at first.” https://www.meisterplanet.com/journal/2004/05/09/richard-stallman-su-and-the-wheel-group/ https://www.meisterplanet.com/journal/2004/05/09/richard-sta...

execat 1y ago

What's their end game here? What is Microsoft gaining from their push to passkeys? They knew this was going to piss off a lot of people, but they went ahead with it anyway. That makes me believe there's something else at play. My experience with passkeys has been worse that my Bitwarden password auto complete, so needless to stay I'm sticking with my regular passwords on my Bitwarden (I know Bitwarden has Passkeys support. I don't want to use it)

hakfoo 1y ago
I suspect it's another step in the push to make the mobile device the centre of digital identity. (Yeah, it might support some standalone key devices, but nobody's giving Joe Sixpack a Yubikey) The one with far more data gathering capability and generally less robust ability for the end user to assert control over it, and which is generally tied to a service contract that in many countries requires identity verification.
- tacticus 1y ago
  That would require all the microsoft auth platforms to allow you to use yubikeys or similar instead of default forcing you in to ms authenticator only
  - jdmoreira 1y ago
    Microsoft authenticator supports YubiKeys
ocdtrekkie 1y ago
So in business Microsoft cloud land, not using Microsoft Authenticator specifically is basically impossible. You have to shut it off four different ways even if you have an alternative solution already configured. I think centralizing control is absolutely the core play for them.
RataNova 1y ago
Feels like they're betting big on being seen as a leader in "passwordless" security

foobarbecue 1y ago

This will be delayed. Anyone want to bet me?

xp84 1y ago

This is missing an important piece of information. If I open Authenticator on iOS I see this message front and center: > Autofill via Authenticator ends in July 2025 You can export your saved info (passwords only) from Authenticator until Autofill ends. Access your passwords and addresses via Microsoft Edge at any time. To keep autofilling your info, turn on Edge or other provider. (Learn more) not sure the full Android feature set, but MS is moving their iOS autofill provider to the Edge app, which doesn’t mean I have to use Edge to browse, just changes which app hosts the passwords. I can still fill them using the native mechanism for any password manager to provide passwords to any password field. Microsoft is not forcing anybody to adopt passkeys as far as I can tell. Although overall people should because passwords are quite frankly a broken idea. Almost as broken as the idiotic janky “we just emailed/texted you a code” bullshit that most sites do now instead of TOTP.

TiredOfLife 1y ago
Same with Mozilla they also moved passwords to Firefox from standalone app. The reason for missing information is that this is blogspam an older version of AI slop.

TiredOfLife 1y ago

They just moved the saved password functionality to their browser. Just like Mozilla did.

hulitu 1y ago
> They just moved the saved password functionality to their browser. Just like Mozilla did. Wonderful. The Remote Code Executor now takes care of your pass.... too. What can go wrong ? One thing browsers are recognized for, it is their security record. /s

unethical_ban 1y ago

So what is the recovery mechanism for the passkey? And they don't expect me to have a different passkey per device, right? Otherwise I still need a password every time I login to a new device. And so I'll still need a password/passkey manager that stores that.

charcircuit 1y ago
>So what is the recovery mechanism for the passkey? Similar to a password there isn't a way to recover it if you forget it. >And they don't expect me to have a different passkey per device, right? You can have it show a QR code that you can scan with phone, using your phone as a passkey.
- geocar 1y ago
  > Similar to a password there isn't a way to recover it if you forget it. But dissimilar to a password in that you aren't ever expected to remember it, can't write it down, and in other ways. > You can have it show a QR code that you can scan with phone, using your phone as a passkey. I can't keep my phone in my safe and still use my phone.
  - charcircuit 1y ago
    >I can't keep my phone in my safe and still use my phone. Okay, so don't put it in a safe. The key is stored securely in your phone.
    - mrweasel 1y ago
      > The key is stored securely in your phone. No it's not, what if I drop my phone in the ocean. Sure in terms of encryption, secure storage and so on, it's securely stored. It's just no physically secured. That's what concerns people. What happens if I lose my devices? What happens if I need to access an account which has been secured by a passkey, but I don't have any of my other devices, what do I do then?

RHSeeger 1y ago

I have yet to see a compelling argument for passkeys that is strong enough to overpower it's negatives. - I want to be able to share passwords for accounts with my family (some, but not all of them) - I want to be able to load up my login information from whatever device I am currently working on; my phone, my home computer, my work computer, my wife's phone, etc - I don't want to risk my phone breaking and losing access to all my accounts Something like 1Password or Bitwarden fits all of that perfectly.

Avicebron 1y ago
> see a compelling argument for passkeys It's tied to vendor lock in. Which increases the ability of companies who develop certain technologies for the masses to increase the friction of interacting with things outside of the ecosystem. The argument is that if a user is unable to use an alternative, by hook or crook they will pay increasingly high subscriptions to access the services provided by that ecosystem. This increases a number on a spreadsheet, the only true compelling argument one could say
- re 1y ago
  > It's tied to vendor lock in If you're referring to the inability to transfer passkeys across systems, that should be improving soon. https://blog.1password.com/fido-alliance-import-export-passkeys-draft-specs/ https://blog.1password.com/fido-alliance-import-export-passk... https://arstechnica.com/security/2025/06/apple-previews-new-import-export-feature-to-make-passkeys-more-interoperable/ https://arstechnica.com/security/2025/06/apple-previews-new-...
  - ls612 1y ago
    As long as the passkey spec includes remote snitching (attestation) your keepass open source alternative will exist only because big tech allows it, and it will end when big tech demands it. The entire import/export standard is a red herring.
    - rantallion 1y ago

hsbauauvhabzb 1y ago

I do not support - under any conditions - an application which DESTROYS existing secrets. You can stop supporting new ones, but as soon as you destroy old ones YOU are a vulnerability, Microsoft. How can I ever trust you to not delete secrets in future?

TiredOfLife 1y ago
It doesn't destroy secrets. https://support.microsoft.com/en-us/account-billing/changes-to-microsoft-authenticator-autofill-09fd75df-dc04-4477-9619-811510805ab6 https://support.microsoft.com/en-us/account-billing/changes-...

theginger 1y ago

Is this anything to do with them taking passwords without consent? I rarely use windows, and when I do one of the first things I do is switch from edge to chrome. I think I set up edge and used it once to see what it was actually like, but I was pretty careful about the data syncing / sharing settings. I have the Microsoft authenticator app on my phone, I was pretty careful about the privacy settings on that too, but it's been through a couple of phone upgrades. Somehow all of my passwords were making their way into Microsoft authenticator, so I must have missed something somewhere. I can only imagine how many millions of people must have had their passwords unintentionally slurped by Microsoft if they have been that aggressive with it.

deleted 1y ago

[deleted]

raphael_l 1y ago

Slightly off topic, but the Microsoft Authenticator app on iOS is - in my opinion - the probably worst designed app by a large corporation. Nothing in there works the way you’d expect it to work. And my absolutely favorite thing was when it itself came in the way of seeing the 2FA code for a modal entry and you had the option on the screen to hide the modal for 10 seconds in order to remember the number underneath… See screenshot here: https://ibb.co/5Wh05rsd https://ibb.co/5Wh05rsd

strbean 1y ago
Truly amazing that without the "I can't see the number" option you probably could have seen the number.
- raphael_l 1y ago
  That’s true, but only for my screen size. A smaller device wouldn’t.
jorvi 1y ago
Are you on an iPhone Mini? Just like the 5S / SE before it, corporations just sort of stopped testing that screen size, which leads to dumb UI gaffes like that. Another classic is button or menu text getting truncated. Spotify had that problem on the SE too.
- raphael_l 1y ago
  This was in February of last year according to the screenshot, my device was an iPhone 11 - not a small one, but rather very much standard screen size!
cycomanic 1y ago
Don't worry it's not better on Android either. Since my work has switched to office365 it's just been hassle after hassle. The outlook app on my phone (and I can't use any other method because it has been disabled), frequently looses authentication and I stop getting notifications about calendar events, emails ..., missed several meetings and important emails because of this. When trying to login on my desktop/laptop I get told to confirm using either outlook, MS authentication app. Guess what often I have been locked out on those as well, so now I have to go through the dance of logging in using a sms code instead. It's sometimes even worse, even on mobile I get told to confirm from my authentication app/outlook, where I'm just trying to log in. Authentication request often only come through to my phone on the 3rd of 4th try. So now logging in to check my email suddenly takes 2 min, because I'm trying to get the popup in the app, it doesn't appear, I need to cancel the request, restart ...

ars 1y ago

I don't have a fingerprint scanner on my computer, nor facial recognition. I do not want any kind of password that relies on my phone, because phones break and can get lost. So basically this forces me to change from a password to a PIN and this is supposed to be more secure?

jeroenhd 1y ago
No, this will force you to either install Microsoft Edge on your phone or switch to one of the many other password managers that do offer autofill on iOS. If you weren't synchronising your passwords through the Microsoft authenticator app, you won't be affected at all. If you were, Microsoft has decided to be annoying and make you install their browser to get password autofill support back. Microsoft prefers synchronising passkeys between devices because passkeys are immune to credential stuffing attacks, but you don't have to do what Microsoft wants.
hulitu 1y ago
> So basically this forces me to change from a password to a PIN and this is supposed to be more secure? Yes. I used an alphanumeric pin: my password. The main malware entry point is the web browser.
johnisgood 1y ago
I use KeePassDX and it works quite well. I save the keyfile in a couple of places. Not sure what it has to do with Microsoft, however, but then again, I would never use Microsoft's Authenticator.

hokkos 1y ago

I never ever succeeded in making a passkey log in after generating one.

dontTREATonme 1y ago

My first experience with passkeys was eBay. They implemented them 3-4 years ago, and my password manager, Dashlane picked up on it. They offered to save it and I wouldn’t have to enter a username or password. Great, seemed to work. Until I needed to login on another device and then Dashlane saved that passkey too, but each passkey was tied to the specific device… only it wasn’t clear when I logged in which passkey I should choose, and chose the wrong one and it doesn’t work. After having like 6 different passkeys for eBay I gave up. Now I always decline to use passkeys. They don’t work, idk who uses them but as a fairly tech savvy user, without a very complex setup (chrome, with Dashlane installed) if it’s not working for me it’s probably just not working. I’ll also add. I don’t have a good mental model for what a passkey is or how it works. And again, like most users if I don’t really understand what’s going on I’m just not gonna bother with it. For all the complexity that it takes to implement secure login with a username and password, most of it is hidden from the user, with passkeys it feels like they’re shoving all the complexity front and center, but not explaining any of it.

ashdksnndck 1y ago
Nowadays I use the passkeys with my password manager and everything works across multiple devices. I’ve never been presented with a list of passkeys to select from.
- sydbarrett74 1y ago
  I’ll second this. A combo of KeePassXC (desktop), KeePassium (Apple), and KeePass2Android plus manually synching my .kbdx file makes the passkey experience relatively smooth for me.
  - dale_huevo 1y ago
    So you need three different applications and manually moving around files to achieve a "relatively smooth" experience? I don't think this is the endorsement you think it is.
    - 1y ago

RataNova 1y ago

Killing autofill and saved passwords in Authenticator is a bold move, especially considering how many non-technical users rely on that feature without even knowing what a passkey is

jakub_g 1y ago

One thing unclear: While I understand they want to transparently replace passwords with passkeys for websites that support it, what happens with passwords for websites that don't support passkeys? Also, if someone sleeps over this, they will just lose their passwords to random websites and have to go through account recovery flows?

jeroenhd 1y ago
If you install Edge, you can keep using the synced passwords. They're only disabling password autofill for their authenticator app, they're not throwing your passwords away. The app has been warning about this for a while now. This might catch someone out of guard if they only use the app once a year for something bureaucratic, but I doubt a credential like that will be stored in Microsoft's authenticator app.

rambambram 1y ago

Wherever I work, IT departments expect me to install MS Authenticator on my own smartphone. To authenticate myself to MS so they can authenticate me to the organisation that already has seen my passport and my driver's license. No thanks...

jonathanlydall 1y ago

For those who may not have read the article fully, Microsoft's existing traditional password management on mobile devices is not becoming unavailable, but is being moved from the Authenticator App to Microsoft Edge. I had this warning show up in the iOS Authenticator app like last week or something and it guides you through changing your iOS settings to instead use Edge as a password manager. As Edge is my browser of choice on my Windows PC and I already had it installed on iOS, this was a very minor inconvenience for me. It's worth mentioning that even though I almost exclusively use Safari as a web browser on my iOS device, when filling in passwords on websites it seamlessly allows you to use any iOS configured password manager including Edge. It's definitely a little weird that you now require Edge to also be installed for essentially the same functionally and Microsoft might be doing it to try push people to install Edge.

sydbarrett74 1y ago
I think you’re right about Edge being the real play here. MS wants to increase Edge adoption and dig at Google. Passkeys are a pretext.
m463 1y ago
also I've noticed with multiple forms of authentication the slack will be taken up by microsoft having your phone number.
reval 1y ago
This makes me feel a little better about this change. However, there are bound to be weird Edge cases. Edge allows multiple profiles, are all always available to store passwords? Can your IT department block the use of personal profiles if you’re logged into a company profile?

wkat4242 1y ago

What a dick move. I don't want to use edge, it's a terrible browser. And most sites don't support passkeys. I'm glad I don't use Microsoft crap but use everything self hosted so I can decide for myself what I want.

ano-ther 1y ago

It’s also annoying that MS requires a personal account for backing up the Authenticator data to iCloud to ”provide an additional layer of encryption“. That description makes little sense, and at least they could honor my paid business subscription (and back it up to there if they don’t trust iCloud).

meindnoch 1y ago

Microsoft continues its was against its own users.

jeroenhd 1y ago

What a terrible article. The text suggests that Microsoft wants to force you to use passkeys, followed by an attempt by the writer to convince you to use passkeys, when the actual news is "you need to install another app to get autofill from Microsoft's password sync service". You can just install Edge. From what I can tell, you don't even need to browse using Edge to use passwords. If you don't use Microsoft Authenticator, nothing changes. If you do, probably because IT makes you, you've already seen the warnings about this.

karel-3d 1y ago

Apple keeps pushing PassKeys to me. Also, Apple requires at least one AppleID password, that I need to keep entering at random intervals - usually when I update any device, but sometimes randomly when I buy stuff on App Store. Also I still need a Mac user password, which is a different password, of course.

latexr 1y ago
> Also I still need a Mac user password, which is a different password, of course. Why “of course”? No one is stopping you from using the same password there. Also, you can optionally turn on the option to be able to reset your Mac’s password with your Apple Account password.
- karel-3d 1y ago
  I mean that it's a different concept; a different thing. You can set it as the same thing but need to remember keeping it same. (There is also an Apple Recovery password, but that's for encrypted recovery, a different thing, but that is very hidden and experimental.)

cycomanic 1y ago

What I don't understand with the push for passkeys, is that for years we have been told we need at least two factors for secure authentication, something we have and something we know. Now with passkeys, it seems we are just throwing all those arguments overboard and are saying 1 factor (something you have, e.g. hardware device) is enough. I've not read anywhere a good argument why. Sometimes people have been arguing that the passkey should still be locked into e.g. another password manager with password, but that doesn't seem to be the case with most implementations, am I missing something?

kemotep 1y ago
Passkeys are quite disappointing in practice. I feel like they were described as ssh keys for website logins but they seem to be half-baked. Accessibility concerns and vendor lock-in are certainly an issue. Definitely stick to keeping passwords and passkeys in a password manager for portability. KeepassXC and Bitwarden (which can be self-hosted) work best for this in my opinion.
- al_borland 1y ago
  Why would I keep them separate? What does this achieve?
  - anonymars 1y ago
    Are you replying to the right post or did parent edit?
    - al_borland 1y ago
      I’m now not sure if there was an edit or if my brain inserted a word. When I replied, I thought I read that they were saying to keep passwords and passkeys in separate password managers, but maybe I’m just going crazy.
  - kemotep 1y ago
    Keep what separate?

creatonez 1y ago

Yes, Microsoft is the worst company ever. ...But this article headline is insanely misleading by not mentioning it's being migrated to Edge. To the point where I'd call it a smear crafted for maximum clickbait shock value. Nothing is being wiped, it's just being moved to a different app. Sure, there's good reasons to not like that app (it's the Internet Explorer sequel after all), but the story here is not as extreme as implied.

joshstrange 1y ago

I am skeptical of passkeys. Not of the technology itself exactly, but people’s implementation of it. Username/password is much easier to grok (for developers and users) and while it absolutely has downsides, as a user, I can fully protect myself with username/password (unique password per site). Passkeys might allow for fewer _user_ footguns but I worry there more _developer_ footguns. Also as a “power user”, I don’t want to deal with passkeys when I’m trying to automate something or scape my own data out of a website. It’s just another complication and I worry that anything edge-case-y (even approved methods) will break or have complications if you use passkeys (think app-specific-passwords when 2FA rolled out for gmail access). Because of this I consistently decline passkey usage until such a time that I feel it’s better understood by the people implementing it.

ReptileMan 1y ago

Microsoft authenticator is such a travesty. Proprietary 2FA, no standards, can't export the seed.

yodon 1y ago

I recently replaced my iPhone with a newer model. All the Microsoft accounts in my Microsoft Authenticator broke when I restored onto the new iPhone. None of the non-Microsoft accounts stored in the same Authenticator app broke. No, Microsoft, I don't trust you to manage passkeys for me.

nashashmi 1y ago
Was your Authenticator backed up in iCloud?
- yodon 1y ago
  > Was your Authenticator backed up in iCloud? Yes

mzajc 1y ago

Besides other inconveniences mentioned here, I'm very concerned about "passkey provider attestation" (see: walled garden). This was already brought up as a threat against KeepassXC because their implementation allowed "too much" user choice: [1]. Does anyone know if this kind of anti-user attestation has been or can be deployed? I really can't understand why anyone would promote passkeys in good faith if that's the case. [1]: https://github.com/keepassxreboot/keepassxc/issues/10407#issuecomment-1994673954 https://github.com/keepassxreboot/keepassxc/issues/10407#iss...

1970-01-01 1y ago

All because of advertising. Strong passwords + not tying the account to an email address is the most phishing resistant thing one can do, however nobody is allowed to do this because they need your email address for advertising. Stop welding my identity to an email address and the entire problem becomes an order of magnitude easier to manage and maintain.

blindriver 1y ago

What happens if you lose your phone? I can’t find any explanation of passkeys that explains how I recover if my phone dies, gets stolen etc.

deleted 1y ago

[deleted]

mathiaspoint 1y ago

Wait so are people just going to lose their passwords? That seems like terrible PR for a company that want to shift to services. If you rug people just for marketing reasons like that why should anyone trust you with important business processes. This won't be something people can just ignore, if I lost my (homebrew for exactly this reason) password manager it would probably cause close to 40 hours of time cleaning up the mess spread out of months. We're talking about millions, potentially even billions of dollars worth of destruction depending on how many people were stupid enough (yes that's the appropriate word although it's more obvious now) to trust Microsoft to maintain their secrets for them.

burnt-resistor 1y ago

Who trusts Microsoft with their passwords, seriously? And passkeys are even worse because they're user hostile, dev hostile, and stuck in a walled-garden. Passwords and 2FA (TOTP or passkeys or something else, with a recovery code mechanism), not just passkeys, or GTFO.

rekabis 1y ago

This is a very smh facepalm bridgepinch sigh moment, where Microsoft could have taken the high road and gently educated users by restricting insecure passwords instead of blocking their use entirely. A simple bit complexity algorithm like what KeePass uses could determine a threshold beneath which restrictions on adding/using passwords could start to bite. I only use their app for Microsoft resources, as the 2FA and other security features are stronger through the app than through other 2FA channels. The 2FA itself, for example, is plumped up from 6 to 8 digits. And there is a challenge/response code you can use as well. But still, IMO this was a massive missed opportunity.