Windows 10: List/Remove Windows Hello FIDO2 resident Keys

Andrea Giacomin · Jul 9, 2020

Hi,

is there a way to list and delete FIDO2 resident keys stored on a Windows 10 device using Windows Hello?

For example, if you use this WebAuthn demo application https://webauthn.io/ and set the registration with resident key, where the keys are saved?

Thanks

:)

Monstieur · Jul 9, 2020

How to list / delete FIDO2 Resident Key credentials from Windows Hello

When using Windows Hello to register with a WebAuthn-enabled website, the credential type can be set to "Resident Key", such as with a Microsoft Account (or on Anmelden – Google Konten by
editing the settings in the menu). Resident credentials are stored on the device (Windows Hello TPM / Software device, or a FIDO2 security key).

On a YubiKey 5Ci you can list / delete these credentials from the CLI with the commands ykman fido list / delete. How do I do this for Windows Hello?

Brink · Jul 9, 2020

Windows Hello & FIDO2 Security Keys authentication for shared devices

Are you tired of entering usernames and passwords? Windows Hello and FIDO2 Security keys allow you to carry your identity with you.

We have been on a journey to eliminate passwords. Today, we are delighted to announce an important milestone.

Microsoft has been aligned with the Fast Identity Online (FIDO) working group from the start, the alliance represents 250 organizations from various industries on a joint mission to replace passwords with an easy to use strong credential. With the recent ratification of FIDO2 security keys by the FIDO working group, we’re updating Windows Hello to enable secure authentication for many new scenarios.

FIDO2 Security Key

Imagine a helpdesk scenario where an employee can walk up to any device and simply log in using Windows Hello and not username and password. Another scenario is hospital medical staff that need access a patient records on a device no matter where the patient is located. Or a public-sector organization that wants secure authentication on devices while adhering to security policies and directives where the users credential needs to be physically separate from the device itself.

Microsoft and its partners have been working together on FIDO2 security keys for Windows Hello to enable easy and secure authentication on shared devices. Security keys allow you to carry your credential with you and safely authenticate to an Azure AD joined Windows 10 PC that’s part of your organization. A user can walk up to any device belonging to the organization and authenticate in a secure way – no need to enter a username and password or set-up Windows Hello beforehand. Unlike traditional passwords, these keys rely on high-security, public-key cryptography to provide strong authentication. These keys have all the benefits of a Trusted Platform Module (TPM) while also being portable enabling the increasing number of mobile workers.

FIDO2 compliant security keys provide secure authentication, independent of the form factor. The security key holds your credential and can be protected with an additional second factor like fingerprint (integrated into the security key) or a PIN to be entered at the Windows sign-in.

Our partners are working on a variety of security key form factors. Some examples include USB security keys and NFC enabled smartcards, just to name a few. We are looking forward to seeing new form factors and possibly applications on your phone that comply with the FIDO2 specification.

Here’s a glimpse into the security keys from our partners we’ve been working closely with

Yubico – Security key for Windows Hello

wl479T2t6eo

HID – Security key for Windows Hello

kGoinG7ru1U

Feitian – Security key for Windows Hello with biometric sensor

bgyNfUawXJo
Click to expand...

Source: Windows Hello and FIDO2 Security Keys enable secure and easy authentication for shared devices - Windows For Your Business

Brink · Jul 9, 2020

Windows Hello & FIDO2 Security Keys authentication for shared devices

Are you tired of entering usernames and passwords? Windows Hello and FIDO2 Security keys allow you to carry your identity with you.

We have been on a journey to eliminate passwords. Today, we are delighted to announce an important milestone.

Microsoft has been aligned with the Fast Identity Online (FIDO) working group from the start, the alliance represents 250 organizations from various industries on a joint mission to replace passwords with an easy to use strong credential. With the recent ratification of FIDO2 security keys by the FIDO working group, we’re updating Windows Hello to enable secure authentication for many new scenarios.

FIDO2 Security Key

Imagine a helpdesk scenario where an employee can walk up to any device and simply log in using Windows Hello and not username and password. Another scenario is hospital medical staff that need access a patient records on a device no matter where the patient is located. Or a public-sector organization that wants secure authentication on devices while adhering to security policies and directives where the users credential needs to be physically separate from the device itself.

Microsoft and its partners have been working together on FIDO2 security keys for Windows Hello to enable easy and secure authentication on shared devices. Security keys allow you to carry your credential with you and safely authenticate to an Azure AD joined Windows 10 PC that’s part of your organization. A user can walk up to any device belonging to the organization and authenticate in a secure way – no need to enter a username and password or set-up Windows Hello beforehand. Unlike traditional passwords, these keys rely on high-security, public-key cryptography to provide strong authentication. These keys have all the benefits of a Trusted Platform Module (TPM) while also being portable enabling the increasing number of mobile workers.

FIDO2 compliant security keys provide secure authentication, independent of the form factor. The security key holds your credential and can be protected with an additional second factor like fingerprint (integrated into the security key) or a PIN to be entered at the Windows sign-in.

Our partners are working on a variety of security key form factors. Some examples include USB security keys and NFC enabled smartcards, just to name a few. We are looking forward to seeing new form factors and possibly applications on your phone that comply with the FIDO2 specification.

Here’s a glimpse into the security keys from our partners we’ve been working closely with

Yubico – Security key for Windows Hello

HID – Security key for Windows Hello

Feitian – Security key for Windows Hello with biometric sensor

Click to expand...

Source: Windows Hello and FIDO2 Security Keys enable secure and easy authentication for shared devices - Windows For Your Business

Windows 10: List/Remove Windows Hello FIDO2 resident Keys

List/Remove Windows Hello FIDO2 resident Keys

List/Remove Windows Hello FIDO2 resident Keys

List/Remove Windows Hello FIDO2 resident Keys

List/Remove Windows Hello FIDO2 resident Keys - Similar Threads - List Remove Hello

Is it possible to log in locally to Windows Home using FIDO2 or Windows Hello?

Is it possible to log in locally to Windows Home using FIDO2 or Windows Hello?

Is it possible to log in locally to Windows Home using FIDO2 or Windows Hello?

Hello. I live in Iran and my country is not in the list of countries of residence, and...

Hello. I live in Iran and my country is not in the list of countries of residence, and...

Windows 11 22H2 - FIDO2 Security Key logon not working

How to list / delete FIDO2 Resident Key credentials from Windows Hello

Windows Hello FIDO2 certification gets you closer to passwordless

Windows Hello & FIDO2 Security Keys authentication for shared devices