tech
New Pass-ta-key attack reveals all the things we didn't know about passkeys
Why passkey apps treat Windows differently than other operating systems.
TL;DR
- The 'Pass-ta-key' attack can extract passkeys stored in Google Password Manager on Windows if the machine is infected with malware.
- Contrary to common belief, FIDO 2 specifications do not mandate passkeys be stored in hardware security modules (like TPMs); most platforms store them locally for syncing.
- Windows apps generally run with higher privileges than on other OSs, making them more vulnerable to malware accessing sensitive data, including cloud-synced passkeys.
- Passkeys are designed to be more secure than passwords by preventing phishing and server-side credential breaches, but they are not intended to withstand attacks on a fully compromised device.
- The risk demonstrated by Pass-ta-key is not novel and is similar to risks associated with password managers on compromised systems.
- The tradeoff between security and usability led to the synchronization of passkeys across devices, moving away from isolated hardware storage.
- While passkeys offer advantages like phishing resistance, users seeking maximum security can opt for solutions that utilize hardware security, like Windows Hello, YubiKeys, or iOS native solutions.