A security researcher at Palo Alto Networks recently disclosed an attack method called Pass-ta-key that can extract all passkeys stored in Google Password Manager on Windows systems when the device is infected with malware. The disclosure generated concern among security professionals and users about the safety of passkeys, which are intended to provide more secure authentication compared to traditional password-based methods.
The attack works because passkeys are stored differently across operating systems. Contrary to common assumptions, the FIDO 2 specification does not require passkeys to be stored in secure hardware like the TPM (trusted platform module). While Microsoft allows Windows users to store passkeys in the TPM, most other platforms store them locally on devices. Third-party developers made this choice after determining that requiring TPM storage made synchronization across multiple devices impractical, and widespread adoption of passkeys depended on easy syncing capabilities.
Windows presents a different security environment than other operating systems. While macOS, iOS, and Android employ strict application sandboxing that prevents malware from accessing isolated app data, Windows generally allows applications to run with user-level privileges. This means malware on a Windows device has fewer barriers to accessing data from other applications. Recognizing this architectural difference, many third-party developers including Google, 1Password, and Dashlane opted to store Windows passkeys in end-to-end encrypted form on cloud servers rather than locally, using device or user keys from the TPM to authenticate and retrieve them.
Security experts note that the Pass-ta-key attack is not fundamentally novel. The underlying vulnerability exists whenever malware gains access to a device that is already authenticated to sensitive accounts. This risk has long existed with password managers and any credential storage system. The attack demonstrates that once a Windows device is compromised while logged in, attackers can access all stored credentials regardless of the authentication method used.
Passkeys are designed to eliminate shared secrets vulnerable to phishing and server breaches, but they are not intended to protect against physical compromise or malware on the device itself. The research, while not presenting new attack categories, may help users better understand the security implications of device compromise and the importance of maintaining clean systems when handling sensitive credentials.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI