SOT: Amazon login problem

I suspect that might not actually be an Amazon problem ?

I sometimes get something that sounds very much like that when I try to get on to eBay

You won't be telling amazon your PIN, windows Hello will verify your PIN locally (can also use face or fingerprint) and then send the passkey to amazon for them to check.

You can sign-in to amazon, go to the account and lists page, then login and security, then the passkey section, you can delete it, but watch out for amazon's sly techniques for getting you to create another passkey.

I tried that but the account page says passkey is not set up.

Then what you're seeing might be their sly attempt to get you to add a passkey ...

What is this 'windows' thing?

There's nothing Windows specific about passkeys, you could use them in browsers on Linux, it's just that on Windows it uses the native authentication as the way to access them.

FIDO2 is baked into Linux

Amazon keep trying to push passkeys on me. They just send the passkey at me when logging in without any preliminary steps saying what they're doing, so I get a Firefox popup asking about saving the passkey. When I say cancel, it pops up again next time I login.

Theo

I see what you mean. I was trying to delete in Amazon but I think you were suggesting deleting the passkey in W11, which I have now done.

eBay was one of the passkeys I deleted.

I didn't understand a word of that.

I have used amazon for years and It never asked me for a PIN or a passkey.

It may well be, but Amazon has never asked me for it.

I just have an email/password stored in the browsers

I have email and password stored in my head, I use amazon enough not to forget it (the password that is).

For less frquently used passwords I use a GPG encrypted store.

Storing passwords in the browser always seems rather insecure to me, you only have to leave your desk (or laptop) for a while and someone else can use it - and your login passwords.

Rest assured, your passkey is never transmitted off your device[.

Passkey authentication are based on FIDO alliance standards:

Your machine holds the private key (typically in the secure encrypted storage in the TPM when available)[1], the web site holds the public one.

When you login to the web site your device can access the public key that is associated with your account. You device can then validate that using the private key, and it can generate a one time token to send to the site to permit login.

The technology is inherently superior to passwords for a number of reasons:

The web site no longer holds a central database of credentials that can be attacked or breached. You are not passing your private credentials over the internet so can't be tricked by fake phishing web sites. It is also a form of Multi Factor Authentication since to login you need your specific device (one factor - something you have), and also your pin (something you know) or your biometric (something you are).

The process is also one stage - no need to enter a separate One Time Password (OTP) generated by an authentication app, or sent via SMS etc)

Is one of the advantages of passkeys over passwords that you have to give your computer the unlock code every time you use it whereas passwords often are autofilled at any time you are logged in?

It's the same unlock code for each password of course (on that machine), so you can use a high-strength ID process with each site without having to learn or look up a lot of different long passwords?

nib

But does this not mean using a passkey for Amazon that is the same as the PIN for the computer when we are told never to use the same password twice? If someone hacks into the PC, does this not make it much easier to hack into any site using passkey?

BitWarden and Lastpass provide the ability to require a master password (or on a phone, biometric) reauthentication before providing login or card details.

As I explained, the PIN isn't your passkey, amazon never sees your PIN,

if you use passkeys, you get a separate one for each website, you keep the private part, the website keeps the public part, they're only of use for the website they relate to.

But the code you use locally to unlock the crypto storage to get the private parts is just the machine's unlock code, always the same?

nib

Yes, if you have set a windows PIN to logon or unlock, it *is* that PIN, if you use face or fingerprint unlock, you use that instead. I have a USB fingerprint dongle, amazon and ebay tell the browser to "light it up" so I know to touch the sensor to complete login.

If you have setup passkeys, you don't have to use them to login, you can choose to use password and/or MFA instead (if you're not on the machine that holds your passkey).

Unfortunately not many other websites use passkeys ...