SECURITY - Frustrating and Dangerous Click Through to Wrong Passkey Device

Prerequisites

• Write a descriptive title.
• Make sure you are able to repro it on the latest version
• Search the existing issues.

Steps to reproduce

Gaah! This is REALLY infuriating !!! Why does a MSW update have to triple the inconvenience of using 2FA when we need it? And yes WE DO NEED TO 2FA every login to a server, and every Git commit!

Please get the SSH key associated with the hardware security key. No I am not going to consider something other than redundant hardware security keys for something like this, I've had malware hacks leap from mobile to desktop hosts myself. Nor should anyone be forced away from hardware security keys.

Use FIDO SSH key .
Login to remote system with SSH (ie. 'ssh git@github.com') .

"iPhone, iPad, or Android device"

Expected behavior

#~/.ssh/id_ed25519_sk
#~/.ssh/id_ed25519_sk.pub
ssh git@github.com

"Security key"

Actual behavior

#~/.ssh/id_ed25519_sk
#~/.ssh/id_ed25519_sk.pub
ssh git@github.com

"iPhone, iPad, or Android device"

Error details

No response

Environment data

#~/.ssh/id_ed25519_sk
#~/.ssh/id_ed25519_sk.pub

Version

OpenSSH-Win64-v9.2.2.0.msi (MSW) ; OpenSSH_9.4p1, OpenSSL 1.1.1w 11 Sep 2023 (cygwin)

Visuals

Reproduce the behavior with ~/.ssh/id_ed25519_sk and the command ssh git@github.com on the reported OpenSSH-Win64 environment. Compare the displayed passkey device with the expected "Security key" result, then trace the SSH/FIDO authentication entry point responsible for device selection. Done means the hardware security key is selected or clearly identified instead of an iPhone, iPad, or Android device.