Well, that already is the deciding question here: where did you store that login-passkey? From what you wrote, it sounds like Windows Hello. And it seems, Windows Hello supports storing PRF-capable passkeys now, but so far we have no report that it worked successfully. (I know, that sounds complicated – here the whole discussion: Encryption (PRF) via Windows Hello passkey?)
First, there is no “PRF-setting” – it either works with PRF, or it doesn’t work with PRF (when not all requirements are met). And the “blog instructions” cover all possibilities, as far as I see – but they can’t predict where you try to store the login-passkey or what OS and browser you are using…
(PS: with up-to-date (!) browsers and OS, PRF should be supported on that front…)
I’m also not familiar with the technical details… But as written before: you neither need nor can enable it. If all conditions are met, it works. (OS, browser, and the “authenticator” must all support PRF – BTW, the “authenticator” here is just the name for the location where you store the passkey – and from where you use it then subsequently…)
I don’t think so. There are actually two BW-login-passkeys:
-
with encryption = need PRF → make it possible to log in with that passkey without the master password and without 2FA
-
without encryption = work also when PRF is not supported → make it possible to log in with that passkey without 2FA, but still needs that you enter the master password (–> without encryption means, that passkey can’t decrypt your vault, therefore the master password is still needed)
So, it’s possible to log in to the web vault and the Chromium browser extensions with both kind of login-passkeys – but only those with encryption/PRF work without entering the master password.
In the web vault you can see if a passkey is created with encryption, or if encryption is supported (and you can upgrade to it) or not supported:
(screenshot from Log In With Passkeys | Bitwarden)
