Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
Microsoft IT

Microsoft Makes New Accounts Passwordless by Default 139

Posted by msmash from the moving-forward dept.
Microsoft has taken its most significant step yet toward eliminating passwords by making new Microsoft accounts "passwordless by default." The change means new users will never need to create a password, instead using more secure authentication methods like biometrics, PINs, or security keys.

The move builds on Microsoft's decade-long push toward passwordless authentication that began with Windows Hello in 2015. According to company data, passkey sign-ins are eight times faster than password and multi-factor authentication combinations, with users achieving a 98% success rate compared to just 32% for password users. Microsoft also said it now registers nearly one million passkeys daily across its consumer services.
This discussion has been archived. No new comments can be posted.

Microsoft Makes New Accounts Passwordless by Default More

Microsoft Makes New Accounts Passwordless by Default

Comments Filter:

  • what dummies lmao (Score:5, Insightful)

    by Anonymous Coward on Thursday May 01, 2025 @08:10PM (#65345943)
    A PIN is nothing more than a password.

    • Re:what dummies lmao (Score:5, Informative)

      by mysidia ( 191772 ) on Thursday May 01, 2025 @09:05PM (#65346067)

      Huge difference for this case. The PIN is only locally significant and used to unlock a credential stored on your device.
      Your PIN is never sent over the network like a login password is.

      What makes passwords vulnerable is they are used directly in an authentication protocol.
      With locally-sigificant PINs the PIN is not part of the authentication protocol. The authenticator is on your computer,
      and the PIN is simply used as an additional factor to unlock the authenticator on your computer.

      • Re: (Score:2)

        by MeNeXT ( 200840 )

        So what is being sent? A password? Why do I need to send anything over the network when I'm logging into my system?

        • Re: (Score:2)

          by caseih ( 160668 )

          I'm surprised by this question. This is slashdot. We push https and ssh keys, both of which don't send private keys over the wires. Cryptographic challenges are used, with they keys remaining local. To be secure, MS must be doing something very similar. Perhaps even storing your keys in the TPM under Windows.

        • A session key negotiated similar to (but not) Diffie-Hellman key exchange using TLS and the PKI to ensure secured communication with the authentication provider.

          Lookup FIDO protocol for more info.

          • Re: (Score:2)

            by MeNeXT ( 200840 )

            That can be accessed by a PIN? Why not just keep the password and send the key? I use FIDO. I don't need a 4 digit PIN.

            • Re: (Score:2)

              by mysidia ( 191772 )

              Why not just keep the password and send the key?

              This is to ensure normal humans can remember their password without having to write it down. The idea is you should use a simple password to help minimize the chance you forget the password. Brute force is prevented by the nature of the authentication protocol. Also the local device will have a tries counter. For example: If you insert your Yubikey and get the PIN wrong 3 times, then the token will be locked out and no more attempts are possible.

              • >"This is to ensure normal humans can remember their password without having to write it down."

                People wouldn't have problems remembering their password if stupid, outdated, "security practices" didn't force them to change the password all the time. Way before NIST (I think it was) *finally* admitted that aging passwords *reduced* security, I was fighting with auditors who insisted that I should implement password aging. So of course they have to be poorer quality, and written down. And of course all

        • "Why do I need to send anything over the network when I'm logging into my system?"

          You don't have to. You can still setup a fully local account, but this will have a password.

          Passwordless (secured by multi-factor) would be a bit complicated for users to setup locally, but a motivated individual could do it.

          There are benefits to having this sort of service though. Your laptop might be stolen and if your accounts are all associated with MS through this scheme, you can remotely remove access from everything tha

          • Re: (Score:3)

            by MeNeXT ( 200840 )

            If the laptop is stolen I don't have the key. Right now I have an encrypted DB that I can copy/move from system to system. I need a password to access my system and another for the DB. If my laptop is stolen the disk is encrypted and requires a password and another for the DB key to access the passkeys. How is a PIN more secure than my passwords?

            Why would I entrust a company that is changing it's business model to make me a product with my credentials?

            This is just more lock-in for the lazy. If it's importan

            • "You need to generate the keys and make sure the private key is private"

              Yeah, that's how FIDO works. Look it up. That's why you can't export access from one device to another. The keys are literally locked inside a TPM module.

              • Re: (Score:2)

                by MeNeXT ( 200840 )

                So let me get this straight. Your point is it's more secure to use a PIN with TPM rather than a password with TPM?

                The issue I have with TPM is that if I lose access to the TPM device then I lost access unless I have more than one TPM device.

                No matter what if it's important to you you need to take the time to secure it.

      • Re: (Score:2)

        by Bongo ( 13261 )

        Everyone now focus on compromising the device instead.

      • Passwords are not sent over the network either, at they are not with sane authentication methods. OAuth, Kerberos, NTLM, CHAP, etc. all use the passwords or password hashes to encrypt authentication tokens that are passed over the network.

        • Passwords are not sent over the network either, at they are not with sane authentication methods. OAuth, Kerberos, NTLM, CHAP, etc. all use the passwords or password hashes to encrypt authentication tokens that are passed over the network.

          Kerberos, NTLM and most CHAP schemes generally are considered insecure legacy authentication methods that should be avoided.

          They are effectively the same as sending passwords over the network because anyone can use the challenge messages in handshake to launch an offline brute force attack against the password. Most real world passwords are unable to withstand such attacks and thus the effective outcome is indistinguishable from cleartext.

          The solution is replacing insecure legacy bullshit with zero knowled

      • Huge difference for this case. The PIN is only locally significant and used to unlock a credential stored on your device.

        There is no difference between a PIN and a password.

        Your PIN is never sent over the network like a login password is.
        What makes passwords vulnerable is they are used directly in an authentication protocol.

        What makes passwords vulnerable is the use of insecure authentication protocols. If you use a secure zero knowledge proof to establish mutual proof of possession passwords are also never "sent over the network".

        I know for a fact Microsoft knows what a secure authentication algorithm is. They simply refuse to deploy them.

        With locally-sigificant PINs the PIN is not part of the authentication protocol.
        The authenticator is on your computer, and the PIN is simply used as an additional factor to unlock the authenticator on your computer.

        So long as you can just mash the I forgot my pin button a PIN is most certainly not improving security.

      • It is still a password. The underlying mechanism doesn't change the fact that a PIN absolutely *IS* a password.

    • Sure other have said similar. No, locally allowing your private key to be involved in answering challenges is not the same thing. As the "unlock" is all local. Microsoft uses separate key pairs for each mechanism used (pin, face, finger, etc.). But, presence (locale) of keys (talking private side)?? Perhaps a problem. So, I think there are still too many "chicken and egg" scenarios. Also, the concept of what is called "passkeys" and Windows Hello are different... so, if about the former, there is som

    • Re: (Score:2)

      by taustin ( 171655 )

      And generally, a much less secure one, being, usually, 4 or 6 digits, often numbers only.

    • Re: what dummies lmao (Score:4, Informative)

      by linear a ( 584575 ) on Thursday May 01, 2025 @11:18PM (#65346321)
      I suspect they mean"pin and something else", e.g. a device such as a phone.

    • A PIN is nothing more than a password.

      LOL, you noticed that too eh? They have no shame... or are just completely ignorant.

  • just one step short. (Score:5, Insightful)

    by Gravis Zero ( 934156 ) on Thursday May 01, 2025 @08:13PM (#65345947)

    If you only they could make it so that not only isn't a Microsoft account isn't needed but that they don't hound you to make a Microsoft account.

    Windows used to be nice but proprietary and now it's an unending hellscape of nags. I FUCKING HATE WINDOWS.

    • Linux just entered the room.

    • I assume there are still pro editions of Windows where this stuff is more straightforward. If you have opinions on how your machine should be secured, the home edition is not targeted at you.

      • Re: (Score:3)

        by taustin ( 171655 )

        Pro (and I believe Enterprise) have a trick during setup, where you tell it you're going to join a domain (which lets you finish setup with a local account), then never join the domain.

        Nagging to sign into a MS account, however, seems to be eternal.

        • Re: (Score:2)

          by Ormy ( 1430821 )
          Nope, Win10 enterprise never nags me for anything, ever. Although I have an MS account (which I use for playing microsoft's multiplayer video games like Halo) I have never had the OS itself logged in, never even been asked. Also onedrive, cortana, edge, xbox game bar, automatic updates (I apply security updates manually at my convenience), telemetry and all other bloat all permanently disabled.

  • All we need now... (Score:5, Insightful)

    by Excelcia ( 906188 ) <slashdot@excelcia.ca> on Thursday May 01, 2025 @08:20PM (#65345957) Homepage Journal

    ....is Microsoft Accountless.

    • ....is Microsoft Accountless.

      I've been Microsoft Accountless since... let me see... oh, that's right! I've never had a Microsoft account!

    • Heyyy... pssst.... over here .... we got what you want ... accountless Windows... but it'll cost ya... hehe

      Umm. Legit question: there any such thing ? Maybe if you have a site license for a big co or gov you can customize your accounts ?

      • Aside from regular old local accounts, you can absolutely setup your own enterprise authentication scheme. For example, some companies use their Google app logins to login to their Windows machines.

        • So this is much worse than I imagined. It's not like an unpatched webserver ... it's outsourcing your entire authentication infrastructure. That's a bad strategy for self preservation. But thanks for answering my question.

          • >"it's outsourcing your entire authentication infrastructure. That's a bad strategy for self preservation."

            Yep.

            What happens when that outside company has a technical problem? Or has to comply with some new policy or law? Or has to turn over access without your knowledge to law enforcement? Or just doesn't like you for whatever reason?

            "You will own nothing and be happy" Hmm...

          • Nothing says you have to outsource it. Google is just a widely used example of a custom authentication scheme. You can roll your own if you want.

        • You can't bring home a computer and have just a regular old local account any more. Not without going to extreme heroics. If you've found a way, please show your work.

          And your average home user shouldn't have to set up an enterprise authentication scheme.

          • You can still do it. I did it with an LG gram laptop I got from Costco in November. It came with Win11 home. It wasn't hard to find on a search engine. Took about 5 minutes to find, and perhaps 10 more minutes to do it. You have to make sure not to login to Wifi, not to plug in Ethernet, click the right boxes. As I recall, you need to open a command prompt and type some OOBE command, then reboot. And then it is done. I have 1 desktop, 1 laptop, 2 HTPCs all running Win11 with local account. I would have sta

          • I've said this elsewhere, but if you have opinions on security, the home edition of Windows is not targeting you. Get the pro edition, where - as far as I know - this is much more straightforward to setup.

  • "more secure" depends on your definition of security.

    first off, the finger print reader on my main windows laptop for work is absolute dogshit, forcing me to revert back to normal passwords anyways.

    next, i have no real method of transferring those credentials to another machine.

    and no, they are NOT faster. this is only true for things like cell phones that you physically hold. my work laptop? its docked. i need to get up out of my chair to get to the finger print reader. and yes, i know not everyone has thi

    • next, i have no real method of transferring those credentials to another machine.

      that is a feature. The whole point is the credentials are not transferrable therefore not subject to being stolen or reused elsewhere.

      • next, i have no real method of transferring those credentials to another machine.

        that is a feature. The whole point is the credentials are not transferrable therefore not subject to being stolen or reused elsewhere.

        Lovely. So you have to have separate credentials for every machine you log into. This won't slow down people who need to work on multiple machines in the least.

        • You sit down at any machine and use the same key (hardware, biometric, whatever), which gets combined with the device key to allow access to services.

          As the old adage goes, security is something you know and/or something you have.

          When signing into your machine you know the PIN and have the key fob (or fingerprint).

          Once you've signed in though, the services you use can leverage this scheme to tie your access to the device itself. That device key is what you can't transfer. So each new device will likely requ

    • Microsoft MFA is indeed terrible. The problem with it is that your laptop can request MFA any time it likes - so while you're out at lunch you get an alert "approve this login!", but you can't because you're no where near your laptop. Then when you come back to your laptop, the workflow is such crap that it's unnecessarily hard to get a new code and approve it.

      A simple check to say "is the screensaver on? If so, don't attempt re-auth until it's off"' would be a good start - but such things are beyond Micros

  • Yes, but ... (Score:5, Informative)

    by fahrbot-bot ( 874524 ) on Thursday May 01, 2025 @08:48PM (#65346013)

    The change means new users will never need to create a password, instead using more secure authentication methods like biometrics, PINs, or security keys.

    I just setup two Windows 11 systems for a friend and used the little checkbox at PIN creation to allow both letters and numbers, so a PIN can be like a password -- ignoring how they're stored by the back end. Anyway, that was easier for them to remember than just (more) numbers.

  • I don't want to have to deal with 2FA when logging into my device. Lots of things cause you to have to re-auth and when that happens I want to use a password.

    I can safely configure a local account that way whereas it's less secure if I'm required to use an internet account. So, don't force the use of MS accounts.

    • If this was a swipe pattern like on an android phone I don't think I'd blink an eye ... it must be optional in the settings though, like password on screensaver.

      but I'd balk if it required biometrics... Recall is already a non starter... also Microsoft products are 30% generated code according to the boss over there... so that explains why it's garbage use plus anyone using Microsoft is a true serf now... property... irritating AND sad.

    • I can safely configure a local account

      Actually not. Local accounts can easily be thwarted by enabling the hidden Administrator account. https://www.makeuseof.com/wind... [makeuseof.com] Even if you disable this account, it can be worked around by using a PE Boot loader.

      Before Windows started pushing people to use Microsoft accounts, when friends would ask me to fix their computers, I never needed to ask them for their passwords. I would just log in as Administrator (which has no password) and do what I needed to do.

      The one good thing about Microsoft accounts,

      • Why disable Administrator if I can assign a password to it?

        • Did you do that, in your "secure" system? I suspect not. If you haven't, your confidence in your ability to make your local account "secure" may be overrated. The account exists, hidden, without a password, on every Windows system, unless you assign a password or delete the account..

          Even if you do that, it's still possible to boot using a USB stick with a PE loader, and log in as administrator.

        • Besides adding a password, you can rename the Administrator account too. Not much of a security feature, but makes it a guessing game. As this is not a common practice, it is unlikely that software to illegally enter a Windows computer will not be able to.

          Again, not much of a security feature, obfuscation hardly ever is. But it is a time-sink and provides other security systems time to react.

          • I think the negative associations with "Security Through Obscurity" are a bit overblown. Security Through Obscurity can be extremely effective, as long as it's combined with all of the traditional best-practices of security. Things such as non-standard usernames and ports can certainly add a useful layer of security to a system that is already well-secured. The term was meant to shame people who never implemented the traditional forms of security and operated only via obscurity.

      • Re: (Score:2)

        by GrahamJ ( 241784 )

        Even if I used Win11 you'd need to be sitting in front of and logged into my PC to enable the administrator account. MS accounts are less secure because they exist on a remote service I don't control.

        • It is a fallacy to assume that physical proximity to your system, gains you additional security. Most hacking these days is done remotely.

          With a local account, there are no checks, there is no throttling of brute force attacks. If a hacker can get some malware on your computer (a task that is shockingly easy), they can try a thousand passwords a second until they get it right. With a Microsoft account, they can't do that, the system has throttling mechanisms and blacklists and two-factor authentication and

  • https://arstechnica.com/securi... [arstechnica.com]

    4 digits that are good forever.

  • 42% password success rate sounds like bullcrap to me.
    • Oops, 32% as stated in the post.

    • >"32% password success rate sounds like bullcrap to me."

      Probably.

      Maybe it is high on systems that require some stupid 15 character passwords with X symbols and stupid aging (which should not be used). But even then, I doubt it is a 68% login failure rate.

      On systems with REASONABLE complexity and without aging (so the user can actually remember the password), I would estimate an average login success rate of maybe at least 90%. If it is a situation where 2FA is appropriate, then of course that number wi

  • I have a Microsoft Account, with no password.
    My device breaks. How do I sign in to my account from another device while I wait for mine to be fixed?

    • I assume your secondary auth method will be the biometrics they've coerced you into finally giving up.

  • Whoever thinks that biometrics are secure (and speaks German, sorry), should watch the video Ich sehe, also bin ich .... du [media.ccc.de] (I see, therefore I am .... you).

  • And how do we hold Microsoft accountable now?

    • >"And how do we hold Microsoft accountable now?"

      By leaving their products. Voting with your feet and your wallet.

Slashdot Top Deals

I have the simplest tastes. I am always satisfied with the best. -- Oscar Wilde

Close