A security researcher at Palo Alto Networks recently published findings about vulnerabilities in passkey implementations, particularly affecting Google Password Manager on Windows. The research sparked significant discussion within the security community regarding the safety of passkeys as an authentication method.
Contrary to widespread assumptions, passkeys are not universally stored in hardware-based secure enclaves like trusted platform modules. While the FIDO 2 specifications do not mandate hardware storage, most major platforms store passkeys locally on devices. Microsoft remains largely alone in offering TPM-based storage options for Windows users. This design divergence emerged from practical considerations, as developers recognized that synchronizing passkeys across multiple devices would be difficult or impossible if hardware storage were required.
The architectural differences stem from fundamental variations in how operating systems handle application privileges. Windows applications typically run with broad user-level permissions, whereas competing platforms enforce stricter app-level sandboxing by default. This disparity creates different threat models for malware attempting to access stored credentials. On macOS, iOS, and Android, malware isolation mechanisms have proven effective in practice. However, Windows’s more permissive application environment makes it possible for malicious software to access data belonging to isolated applications.
Aware of these platform-specific constraints, third-party developers adopted alternative security approaches for Windows. Services including Google Password Manager, 1Password, and Dashlane now store encrypted passkey data on cloud servers rather than locally on Windows devices. Authentication requests are processed through backend servers using device keys stored in the TPM, creating an additional layer between stored credentials and potential malware. Other platforms’ versions of these same applications continue using local device storage.
While the demonstrated attack variants are noteworthy, security professionals observe that similar risks would apply to other credential management scenarios if a device became malware-infected and fully authenticated to sensitive services. The fundamental challenge remains balancing user convenience, cross-device synchronization needs, and platform-specific security constraints.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI