7

I have a U2F key and use it for two factor authentication with Gmail and Github. Can I use it to login to Windows 10?

I read a blog post "Microsoft Announces FIDO Support Coming to Windows 10" published February 2015. Has the feature shipped? If not, when is it expected?

5

No, Windows does not support U2F for system login. As far as I can gather from the marketingese in that blog post, the FIDO support is about Windows itself acting as a credential – and most likely as UAF (as the primary factor), not U2F.

  • This is no longer true, I'll add details in a new answer. – Jamie Kitson Dec 26 '19 at 12:54
3

Windows 10 does support certain FIDO2 devices, however while there are many keys that are FIDO2 certified by the FIDO Alliance, Microsoft requires some optional extensions of the FIDO2 Client-to-Authenticator Protocol (CTAP) specification to be implemented by the vendor: Resident key, Client pin, hmac-secret, Multiple accounts per RP.1

Also, as I understand it, the key is to be used as a true second factor, ie, you still have to enter a password, PIN or fingerprint, you cannot just use the key alone.

The setting can be found under Sign-in options.

enter image description here

  • 1
    You should quote and cite what those required optional features are exactly. Microsoft is notorious for changing their website and not doing redirecting. Your question doesn’t specify, how the author can enable this functionality, and the linked article doesn’t specify it either – Ramhound Dec 26 '19 at 13:01
  • But finally an answer to "I would like to login with a fido2key AND a password/PIN". How do I find keys that are compliant as described in this answer? Do yubikeys work with this new settings? All of them? – user1840267 Jan 23 '20 at 8:27
0

I think you can use Yubikey for Loging in to windows 7,8,10: https://www.yubico.com/why-yubico/for-businesses/computer-login/windows-login/

  • Can you expand on the relevant sections in your link? This is in case the URL goes offline in the future. Please see How to Answer. – Burgi May 24 '17 at 7:47
  • This uses Yubikeys' programmable OATH mode, not U2F; it won't work with U2F-only keys (neither from Yubikey nor another manufacturer). There's no technical reason why it couldn't be done, though (indeed U2F would avoid some problems which OATH mode has), as in the answer about Rohos. – user1686 Mar 24 '18 at 21:59
  • You cannot use Yubico's program yet if the Windows user account is linked to Microsoft's SSO... it only supports local accounts. – JW0914 Dec 26 '19 at 13:30
0

You also can try Rohos (29$) for a while, it can make u2f as multi-factor or sigle-factor login key - https://www.rohos.com/2018/03/24/windows-login-with-u2f-fido-security-key/

Rohos uses the Windows Credential Provider Framework (https://docs.microsoft.com/en-us/windows/desktop/secauthn/credential-providers-in-windows) to supply the Login Service with a third-party logon module. In this case it's an interface to U2F, Google Authenticator and other mechanisms. You can set it to either work as a second-factor, a combination of factors or as the sole credential for login.

  • While it does kind of answer the question - you might want to flesh out the answer a bit. We have a meta post on what we expect - but in short, answers should be self contained. – Journeyman Geek Mar 24 '18 at 23:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.