Windows 10: Windows 10 2004 asking for "security token" on WebAuthn instead of fingerprint, etc.

TylerBletsch · Aug 8, 2020

Hi, folks. I recently had to reinstall Windows on my laptop due to an SSD failure. My organization has WebAuthn passwordless web SSO which I frequently used before. In the past, when signing up for and using WebAuthn-based sites, I'd use my fingerprint to authenticate to the OS. However, it now asks for a security token which I've never had or used. Other instances of the "Making sure it's you" dialog unrelated to this do correctly allow fingerprint authentication.

Screenshot of the prompt I get: https://i.imgur.com/7JLKAlL.png
Screenshot of prompt I expect to get from another machine: https://i.imgur.com/HFnRDQk.png

This reinstall also took me from Windows 10 1903 to 2004 -- my fear is that the newer Windows verison messed up WebAuthn support, in which case I'm screwed.

What trick or maneuver do I need to do to get normal WebAuthn support working again?

:)

Brink · Aug 8, 2020

Why W3C WebAuthn will change the world

A little over a month ago, W3C WebAuthn became a real internet specification. Most of you don’t know what WebAuthn is yet, but many of you will feel the impact in short order. In fact, I will go so far as to say that WebAuthn may change how we all authenticate to the resources we use every day. We live in a world where the best parts of our individual local hardware and software collection are rarely leveraged to make cloud security decisions. This is because there has never been a vendor-agnostic and privacy-preserving way for cloud resources to interact with individual hardware configurations in any generic way. Until now!

With WebAuthn, any web entity can call a simple Javascript API and ask for a cryptographically secure credential. What happens next is pretty cool – the world’s browsers have worked with the world’s operating system makers and the world’s hardware manufacturers, so that when a website asks for a credential, the browsers work with the underlying platform to securely locate compliant local hardware and talk to it!

All of a sudden, there is a way for all the devices close to us to speak for us. Whether it is my fitness device, a built-in fingerprint reader, a soft token or a roaming security key, we now have credible alternatives for passwords, because the very proximity of my device makes it hard for an attacker to subvert, my devices need to be either built-in, plugged in, or wirelessly connected.

The ratification of WebAuthn is only a first step. While we have agreement on how we can leverage what is locally connected, deployment is still ongoing and it will take time for all the pieces to be available in a way that can be used anywhere, by anyone. One day, your individual collection of devices will form a flexible, recoverable set of ‘authenticators’ that make it very easy for you to get to your cloud resources. We won’t overwhelm you with technology, but rather use what you already keep with you every day.

The most amazing thing about WebAuthn (and companion specs also ratified at the FIDO Alliance) is how many different companies have had to form consensus before this specification could exist. It has been seven years of debate, proposals, interops, working group meetings, editorial tweaks, liaison work with other specifications, evangelism and working code to get us where we are.

Whatever happens, keep an eye out for W3C WebAuthn and FIDO2. And raise a glass to your neighborhood standards engineer, they deserve it.

Cheers, and congratulations on your ratification, W3C WebAuthn and FIDO2 CTAP2!
Click to expand...

Source: Why WebAuthn will change the world - Microsoft Tech Community - 482286

Brink · Aug 8, 2020

Why W3C WebAuthn will change the world

A little over a month ago, W3C WebAuthn became a real internet specification. Most of you don’t know what WebAuthn is yet, but many of you will feel the impact in short order. In fact, I will go so far as to say that WebAuthn may change how we all authenticate to the resources we use every day. We live in a world where the best parts of our individual local hardware and software collection are rarely leveraged to make cloud security decisions. This is because there has never been a vendor-agnostic and privacy-preserving way for cloud resources to interact with individual hardware configurations in any generic way. Until now!

With WebAuthn, any web entity can call a simple Javascript API and ask for a cryptographically secure credential. What happens next is pretty cool – the world’s browsers have worked with the world’s operating system makers and the world’s hardware manufacturers, so that when a website asks for a credential, the browsers work with the underlying platform to securely locate compliant local hardware and talk to it!

All of a sudden, there is a way for all the devices close to us to speak for us. Whether it is my fitness device, a built-in fingerprint reader, a soft token or a roaming security key, we now have credible alternatives for passwords, because the very proximity of my device makes it hard for an attacker to subvert, my devices need to be either built-in, plugged in, or wirelessly connected.

The ratification of WebAuthn is only a first step. While we have agreement on how we can leverage what is locally connected, deployment is still ongoing and it will take time for all the pieces to be available in a way that can be used anywhere, by anyone. One day, your individual collection of devices will form a flexible, recoverable set of ‘authenticators’ that make it very easy for you to get to your cloud resources. We won’t overwhelm you with technology, but rather use what you already keep with you every day.

The most amazing thing about WebAuthn (and companion specs also ratified at the FIDO Alliance) is how many different companies have had to form consensus before this specification could exist. It has been seven years of debate, proposals, interops, working group meetings, editorial tweaks, liaison work with other specifications, evangelism and working code to get us where we are.

Whatever happens, keep an eye out for W3C WebAuthn and FIDO2. And raise a glass to your neighborhood standards engineer, they deserve it.

Cheers, and congratulations on your ratification, W3C WebAuthn and FIDO2 CTAP2!
Click to expand...

Source: Why WebAuthn will change the world - Microsoft Tech Community - 482286

famattjr · Aug 8, 2020

No Password but Windows asks for PW instead of fingerprint scan

This problem existed sporadically under Windows 7 but has gotten worse with Windows 10. When I first set up the computer I was never asked to set up a Windows Log in Password-I was just asked
to enroll a fingerprint which I used to log in upon computer booting or waking up. Every once in a while it would ask me for a PW and the fingerprint scanner would not blink so I would reboot. Now with Win 10 it also sometimes just asks me for a PW which
I don't have. So I just restart until it asks for the fingerprint scan. I'm afraid some day I won't be able to log in with the fingerprint at all. I know I should have an admin password but can't change without the old one, which I never set. A similar question
was addressed in 2011 for Windows 7, but there were several different methods. I want to be sure before I go tinkering. I had an internet chat with a Microsoft rep couple weeks ago who was stumped and was going to get back to me but never did. MS Case #
1299214492 Here is the previous discussion:

Lost admin password, how to retrieve the current password to change it?

Windows 10: Windows 10 2004 asking for "security token" on WebAuthn instead of fingerprint, etc.

Windows 10 2004 asking for "security token" on WebAuthn instead of fingerprint, etc.

Windows 10 2004 asking for "security token" on WebAuthn instead of fingerprint, etc.

Windows 10 2004 asking for "security token" on WebAuthn instead of fingerprint, etc.

Windows 10 2004 asking for "security token" on WebAuthn instead of fingerprint, etc. - Similar Threads - 2004 asking security

Windows Hello knowing when my laptop is closed and asking me for PIN instead of fingerprint

Windows Hello knowing when my laptop is closed and asking me for PIN instead of fingerprint

Windows asked to update fingerprint

Windows asked to update fingerprint

Windows asked to update fingerprint

After fingerprint registration Windows 10 doesn't ask for fingerprint or password on startup.

Hosts file does not exist in etc but Windows folder instead. Windows Security quarantines...

Windows Defender and McAfee Internet Security etc. etc. etc.???

PIN and fingerprint security keeps asking me to reset for some reason.