A security researcher at Palo Alto Networks outlined what was characterized as a novel attack against passkeys, the authentication method designed to replace traditional passwords. The attack, termed Pass-ta-key, demonstrated how malware on a Windows machine could potentially access all passkeys stored in Google Password Manager for Windows, raising concerns among security professionals and end users about the safety of this emerging authentication mechanism.
The discovery challenged widespread assumptions about passkey security. Many users believed passkeys were stored exclusively in the trusted platform module (TPM), a hardened chip component designed to protect cryptographic keys. However, the FIDO 2 specifications governing passkeys do not mandate TPM storage or any dedicated hardware. In practice, most platforms and third-party applications store passkeys locally on devices, with Microsoft being the primary exception by offering TPM storage as an option, primarily for enterprise use.
The difference in storage approaches stems from practical considerations. A few years ago, developers realized that requiring TPM storage made it impossible to sync passkeys across multiple devices, creating a barrier to widespread adoption. Architects determined that local storage on devices was generally secure because app permissions are sufficiently granular to prevent malware from accessing private keys. This assumption has held true on macOS, iOS, and Android, where sandboxing protections prevent unauthorized access unless the operating system itself is compromised.
Windows presents a unique vulnerability. Unlike other platforms, Windows applications typically run with full user privileges, and the operating system’s sandboxing protections work only in one direction, allowing unsandboxed malware to access data from sandboxed applications. Recognizing this architectural difference, multiple third-party developers including Google, 1Password, and Dashlane adopted a different approach for Windows: storing passkeys in end-to-end encrypted form on cloud servers rather than locally.
The Pass-ta-key attack exploits this architecture by using malware access to a user’s Google account and potentially the device key stored in TPM to retrieve encrypted passkeys from Google’s servers. One attack variant involves the infected machine masquerading as an iPhone to trigger synchronization capabilities that transfer passkeys to the compromised device. Security experts noted that similar attacks could occur with any sensitive application fully authenticated on an infected machine.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI