A researcher at Palo Alto Networks recently outlined what was characterized as a novel attack called Pass-ta-key that could extract passkeys from Google Password Manager on Windows devices compromised with malware. The disclosure sparked concern among security professionals and users who believed passkeys stored on Windows machines were protected by the trusted platform module, a hardware-based security component. However, industry specifications do not mandate passkey storage in dedicated hardware, and most platforms store them locally on devices instead.
The design choices reflect fundamental differences in how various operating systems handle application permissions and data isolation. Windows applications typically run with broad user privileges, whereas macOS, iOS, and Android enforce stricter application sandboxing by default. This architectural difference means Windows malware can more readily access data from other applications. Recognizing this vulnerability, developers of credential management applications including Google Password Manager, 1Password, and Dashlane opted to store Windows passkeys in encrypted cloud storage rather than on the device itself.
When users authenticate on these cloud-based systems, the Windows device retrieves encryption keys from the trusted platform module and communicates with the service provider’s servers, which then issue authentication assertions signed by passkeys held in encrypted cloud storage. In contrast, the same applications on other platforms store passkeys locally and perform authentication directly on the user’s device. The Pass-ta-key attack exploits these mechanisms by using malware access to the user’s cloud account and potentially the device keys stored in the TPM to trigger synchronization features that transfer passkeys to the compromised machine.
Security researchers noted that the attack’s severity is comparable to malware gaining full authentication access to any sensitive application on a compromised device. While the disclosure generated discussion about passkey security, the underlying vulnerabilities reflect known differences in platform architecture rather than previously undiscovered weaknesses in the passkey authentication method itself.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI