Windows 10: Where can I locate and manage FIDO PassKeys that I created with Windows Hello?

I have tried using FIDO Passkeys on Windows 10 and it works well for Microsoft Edge, Google Chrome & Mozilla Firefox. I was actually amazed because, Passkeys that were created on Chrome was available for use on Edge and Firefox and vice versa.I totally understand that backup of Passkeys is not yet available however, I will be very happy to locate the locally stored Passkeys so that I can manage them i.e. remove the ones that I do not need anymore.

:)

 

Google bringing passkey support to Android and Chrome

Source: https://android-developers.googleblo...nd-chrome.html

 

Passkeys for Google Accounts are now available

Source: https://blog.google/technology/safet...-the-password/

 

Clear description of using passkeys

Kevin,

The FIDO2 section of the following User Authentication Specifications Overview document at the FIDO Alliance begins with this paragraph.

"FIDO2 is comprised of the W3C Web Authentication specification and corresponding Client-to-Authenticator Protocols (CTAP) from the FIDO Alliance. FIDO2 supports passwordless, second-factor and multi-factor user experiences with embedded (or bound) authenticators (such as biometrics or PINs) or external (or roaming) authenticators (such as FIDO Security Keys, mobile devices, wearables, etc.). "

User Authentication Specifications Overview - FIDO Alliance

Though the portion relating to "embedded (or bound) authenticators (such as biometrics or PINs)" seems to imply that devices like my tablet that contains Windows Hello based biometric hardware might allow it to be used with a built-in authenticator app, in most cases the final portion which mentions "external (or roaming) authenticators (such as FIDO Security Keys, mobile devices wearables, etc.)" would more likely apply.

What I mean here is that it will be up to the website owners (think government or other high security sites) to decide whether they'll accept a particular authenticator, including the version of software and hardware support it includes for use with their service. Though for most typical business websites it may be acceptable to use a device like my tablet to perform the authenticator functions directly, others including Microsoft itself might instead require that these be contained in either a smartphone (mobile device) or even a true FIDO Security Key for more secure sites.

Another paragraph I found on the FIDO Alliance site indicates that it's possible to provide the syncing capability that one of the earlier articles we'd read mentioned Microsoft was planning.

"Organizations can deploy FIDO sign-ins with passkeys across a variety of use cases. Passkeys enable users to access their FIDO sign-in credentials on many of their devices, even new ones, without having to re-enroll every device on every account. Alternatively, device-bound passkeys that are bound to a FIDO security key or platform are an option for organizations that do not require syncing."

Though this also implies it might be possible to sync across ecosystems, I expect this would be significantly more difficult due to cross-platform issues and so don't truly expect to see that.

Personally, I just hope they plan to support devices like the Microsoft Surface tablet that appears to contain the necessary biometric authentication hardware directly via either the Edge browser or at worst a FIDO2 authenticator app on the same device.

The security issue with keychain backups is obvious, since any form of external storage of all your keys is dangerous and if this were an easy to perform action within an authenticator, could be just as easily subverted by malware as a way to seal all of your keys remotely as well.

Rob