usernames not easily readable / identifiable

[timstrasser]

For me the output looks like this: (I did not manually remove any linebreaks, that's exaxtly how it's printed)

  ____                                                      _   _                              _
 |  _ \    __ _   ___   ___  __      __   ___    _ __    __| | | |   ___   ___   ___        __| |   ___  __   __
 | |_) |  / _` | / __| / __| \ \ /\ / /  / _ \  | '__|  / _` | | |  / _ \ / __| / __|      / _` |  / _ \ \ \ / /
 |  __/  | (_| | \__ \ \__ \  \ V  V /  | (_) | | |    | (_| | | | |  __/ \__ \ \__ \  _  | (_| | |  __/  \ V /
 |_|      \__,_| |___/ |___/   \_/\_/    \___/  |_|     \__,_| |_|  \___| |___/ |___/ (_)  \__,_|  \___|   \_/

────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
A small tool built by Anders at https://passwordless.dev to remove Windows 10 WebAuthn Keys
Use the Github repo to report issues or contribute: https://github.com/passwordless/webauthn-fido2-key-remover

Note: To delete keys, you need to run this tool as administrator. If you do not want to do that, you can run `certutil
-csp NGC -delkey <name>` manually.
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
Found 11 keys.
Select keys to delete. Username - sha256 RP ID.
Select keys to delete. Username - sha256 RP ID.

> [ ] 1. sg??h????→???♫xxxxx????w?? -   3f7dd17170d9480ec516f6b02fdxxxxxxxxxxxxxxxx3f39bee85e87395058fcab0
  [ ] 2. *?/???:!???xxxx♣?K??vP???◄?hT? -   4609d127e39f7e8eef71cf1xxxxxxxxxxxxxxxxd5bc96d3bfd68b2e15fe8a719ba3
         -   74a6ea9213c99c2f74b22492xxxxxxxxxxxxxxxx94c1a950a0397f29250b60841ef0                        058fcab0
  [ ] 4. ??]?↓☻?y↕F?☻??♣R☺??↕?⌂?x?xxxx?( -   3f7dd17170d9480xxxxxxxxxxxxxxxx14da65eae89183f39bee85e87395058fcab0                 5. ????6??J=f6u?E1+#?o↕♫??xxxxoyY -   cc750cf9f5def1f3d373b21074053cc61a2746665e0xxxxxxxxxxxxxxxx5517143
  [ ] 5. ????6??J=f6u?E1+#xxxx♫???(?P?oyY -   cc750cf9fxxxxxxxxxxxxxxxx3cc61a2746665e0f39d1a89a9e71d5517143
  [ ] 6. ?0?eG?o??e)??O???I<???rL-xxxx?Q? -   cc750cf9f5def1f3d373b21074053cc61a2746xxxxxxxxxxxxxxxx9e71d5517143
  [ ] 7. ?♂⌂jo?????z?\^?w??M/xxxx??↨-? -   3f7dd17170d9xxxxxxxxxxxxxxxx2fd314da65eae89183f39bee85e87395058fcab0
  [ ] 8. ??U-?↓↑.&h'T◄?♣???Vxxxx∟??iJ7 -   cc750cf9f5def1f3d373b21074053cc61a2746665exxxxxxxxxxxxxxxx5517143

(Move up and down to reveal more keys)
(Press <space> to toggle a key, <enter> to procceed with removal)

So the Usernames are not readably, which makes the tool unusable as it's impossible to find the right key to remove.

[abergs]

@timstrasser Yes, it's a problem with webauthn credentials.
The value that is displayed is the "userhandle" property. The value is a byte[] and by the specification should not contain PII.

I have yet to find documentation on how to retrieve metadata from windows hello credentials containing a name and username. Once that documentation is made public, I could call that API/Data store to fetch human friendly information for each key.

[ragnarbull]

Windows has added a passkeys GUI (ie.for Windows Hello) to the Sep 26 update (KB5030310) for Windows 11 Insiders.

@abergs I don't code C# and I'm guessing you can't get source code or docs on it but maybe there's some blog somewhere explaining how to get the PII out?