Windows 10: Is BLE transport for FIDO2 roaming authenticator on Windos11 supported?

Lorenz David · Jan 15, 2025 at 5:22 AM

I noticed that when trying to add a passkey to an account on Windows10 you are prompted to "insert the security key" or "activate bluetooth".On Windows 11 the prompt only says "insert the security key" which suggests to me that BLE is not supported. I was not able what so ever to add my BLE authenticator to any account on Windows11 while on Windows 10 it worked perfectly fine. The Microsoft documentation however states that it is supported on Windows10 and 11.Any help or guidance on this is highly appreciated!

:)

paul brady1 · Jan 15, 2025 at 5:41 AM

How to Delete Fido2 Platform Authenticators?

Hello

I am working with Fido2 Authenticators on my Win11 system that has a TPM. I have enrolled many test users with a Fido2 Platform Authenticator. The problem is how to delete these off the client without a re-install of windows?

Junaid_A · Jan 15, 2025 at 5:41 AM

Windows 10 Hello for Business with Physical Smartcard and roaming uses across shared PC's

Hi Rosenbrier,

Thank you for writing to Microsoft Community Forums.

With the recent ratification of security keys by FIDO, Windows Hello allows security authentication for shared devices that allows full roaming experience. For more information, I would suggest you to refer to the article
Windows Hello and FIDO2 Security Keys enable secure and easy authentication for shared
devices and see if it helps.

If you have any further query regarding the same, I would suggest you to post your query in the
IT Pro TechNet Forums, where we have support professionals well equipped with the
knowledge on Windows Hello for Business.

Additional Info:

Implementing strong user authentication with Windows Hello for Business

Windows Hello for Business Frequently Asked Questions

Regards,

Brink · Jan 15, 2025 at 5:41 AM

Passwordless FIDO2 verification on Android for Google Accounts

Passwords, combined with Google's automated protections, help secure billions of users around the world. But, new security technologies are surpassing passwords in terms of both strength and convenience. With this in mind, we are happy to announce that you can verify your identity by using your fingerprint or screen lock instead of a password when visiting certain Google services. The feature is available today on Pixel devices and coming to all Android 7+ devices over the next few days.

Simpler authentication experience when viewing your saved password for a website on passwords.google.com

These enhancements are built using the FIDO2 standards, W3C WebAuthn and FIDO CTAP, and are designed to provide simpler and more secure authentication experiences. They are a result of years of collaboration between Google and many other organizations in the FIDO Alliance and the W3C.

An important benefit of using FIDO2 versus interacting with the native fingerprint APIs on Android is that these biometric capabilities are now, for the first time, available on the web, allowing the same credentials be used by both native apps and web services. This means that a user only has to register their fingerprint with a service once and then the fingerprint will work for both the native application and the web service.

Note that your fingerprint is never sent to Google’s servers - it is securely stored on your device, and only a cryptographic proof that you’ve correctly scanned it is sent to Google’s servers. This is a fundamental part of the FIDO2 design.

Here is how it works

Google is using the FIDO2 capability on Android to register a platform-bound FIDO credential. We remember the credential for that specific Android device. Now, when the user visits a compatible service, such as passwords.google.com, we issue a WebAuthn “Get” call, passing in the credentialId that we got when creating the credential. The result is a valid FIDO2 signature.

High-level architecture of using fingerprint or screen lock on Android devices to verify a user’s identity without a password

Please follow the instructions below if you’d like to try it out.

Prerequisites

Phone is running Android 7.0 (Nougat) or later

Your personal Google Account is added to your Android device

Valid screen lock is set up on your Android device

To try it

Open the Chrome app on your Android device

Navigate to https://passwords.google.com

Choose a site to view or manage a saved password

Follow the instructions to confirm that it’s you trying signing in

You can find more detailed instructions here.

For additional security

Remember, Google's automated defenses securely block the overwhelming majority of sign-in attempts even if an attacker has your username or password. Further, you can protect your accounts with two-step verification (2SV), including Titan Security Keys and Android phone’s built-in security key.

Both security keys and local user verification based on biometrics use the FIDO2 standards. However, these two protections address different use cases. Security keys are used for bootstrapping a new device as a second factor as part of 2SV in order to make sure it’s the right owner of the account accessing it. Local user verification based on biometrics comes after bootstrapping a device and can be used for re-authentication during step-up flows to verify the identity of the already signed-in user.

What’s next

This new capability marks another step on our journey to making authentication safer and easier for everyone to use. As we continue to embrace the FIDO2 standard, you will start seeing more places where local alternatives to passwords are accepted as an authentication mechanism for Google and Google Cloud services. Check out to get an early glimpse of the use cases that we are working to enable next.

fsFxbC543n8
Click to expand...

Source: https://security.googleblog.com/2019...r-with_12.html

Windows 10: Is BLE transport for FIDO2 roaming authenticator on Windos11 supported?

Is BLE transport for FIDO2 roaming authenticator on Windos11 supported?

Is BLE transport for FIDO2 roaming authenticator on Windos11 supported?

Is BLE transport for FIDO2 roaming authenticator on Windos11 supported?

Is BLE transport for FIDO2 roaming authenticator on Windos11 supported? - Similar Threads - BLE transport FIDO2

Is BLE transport for FIDO2 roaming authenticator on Windos11 supported?

How does FIDO2 authentication over BLE transport work for browsers that do not support BLE.

How does FIDO2 authentication over BLE transport work for browsers that do not support BLE.

How does FIDO2 authentication over BLE transport work for browsers that do not support BLE.

How to Delete Fido2 Platform Authenticators?

How to Delete Fido2 Platform Authenticators?

windos11

windos11

FIDO2 BLE Bluetooth Communication problem with Android / iOS