A security researcher at Palo Alto Networks unveiled an attack method called Pass-ta-key that can extract passkeys from Google Password Manager on Windows systems when the device is infected with malware. The attack triggered widespread concern because many users believed passkeys were stored exclusively in hardware-protected enclaves like the Trusted Platform Module, making them resistant to malware extraction.
Contrary to widespread assumptions, the FIDO2 specifications do not mandate storage of passkeys in dedicated hardware security modules. Most platforms store passkeys locally on devices, with Microsoft being the primary exception by offering TPM storage as an option. This architectural difference emerged after developers recognized that passkeys would not achieve widespread adoption if synced across devices proved impossible, which would be the case with mandatory TPM storage.
The fundamental distinction lies in how different operating systems handle application permissions. macOS, iOS, and Android enforce strict application sandboxing by default, preventing malware from accessing data belonging to other apps unless the operating system itself is compromised. Windows, however, runs most applications with full user privileges and employs sandboxing protections that only work in one direction, leaving third-party applications vulnerable to malware operating on the same device.
Aware of these security limitations, third-party developers including Google, 1Password, and Dashlane implemented alternative storage mechanisms for Windows: passkeys are maintained in end-to-end encrypted form on cloud servers rather than locally. Authentication still occurs using device keys stored in the TPM, but the actual passkeys remain protected server-side. The Pass-ta-key attack exploits this architecture by using malware access to user accounts and device credentials to trigger synchronization features that transfer encrypted passkeys to the infected device.
Security experts noted that while the attack is notable, the underlying vulnerability is not unique to passkeys. Similar risks would exist if malware gained full authentication access to other credential management applications or sensitive services on an infected Windows system.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI