A security researcher at Palo Alto Networks identified potential vulnerabilities in passkey systems, highlighting significant differences in how various operating systems handle this newer authentication method. The so-called Pass-ta-key attack demonstrated that Google Password Manager passkeys stored on Windows machines could be extracted by malware, contrary to many users’ expectations that such credentials remain secure in hardware-based storage.
The confusion stems from misconceptions about passkey architecture. The FIDO 2 specifications governing passkey standards do not mandate storage in specialized hardware like trusted platform managers (TPM) or secure enclaves. Most platforms and applications store passkeys locally on devices, with Microsoft being the primary exception by offering TPM storage for Windows users. This distinction became necessary because requiring hardware storage made it impractical to synchronize passkeys across multiple devices, hindering broader adoption.
The fundamental issue lies in how Windows handles application sandboxing compared to other operating systems. While macOS, iOS, and Android employ robust app isolation through permission restrictions, Windows typically grants applications broader system privileges. This architectural difference means malware on Windows systems faces fewer obstacles accessing data from other applications. Third-party developers recognized this vulnerability and responded by adopting cloud-based encrypted storage for Windows passkeys, where credentials are maintained on remote servers rather than locally.
With cloud storage, the authentication process relies on device or user keys stored in the TPM, which are presented to backend servers during login attempts. The Pass-ta-key attack exploits this design by utilizing malware-compromised access to user accounts and TPM keys, with one variant causing infected Windows machines to impersonate iPhones to trigger device synchronization features. Security experts note that the practical implications of such attacks parallel those affecting fully compromised credential management systems on any platform, where attackers gain access to stored authentication mechanisms.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI