Passkeys, the new authentication paradigm, have been hailed as a more secure alternative to password-based methods. However, a recent attack called Pass-ta-key has raised concerns among end users and security professionals. This attack, which targets the Google Password Manager app (GPM) for Windows, demonstrates how malware can extract all passkeys stored in the app when the machine is infected. The confusion surrounding this research stems from the misunderstanding of the underlying technology and its limitations.
The Pass-ta-key attack exploits a critical vulnerability in Windows, where apps generally run with all the privileges of the user, unlike other platforms that encourage the restriction of application privileges. This difference in security model allows malware to access the data of a sandboxed app, including passkeys stored locally on the device. The attack is not novel, as it leverages the same principles that have been present in computing security for as long as it has existed.
The FIDO 2 specifications, managed by the FIDO Alliance, do not mandate that passkeys be stored in TPMs or any other dedicated hardware. Instead, most platforms and third-party software store passkeys locally on the device. This shift to local storage was necessary to enable widespread usage of passkeys, as requiring TPM storage made syncing impossible. However, the lack of confidence in Windows security has led to a new design where passkeys are stored in end-to-end encrypted blobs located in the cloud.
The Pass-ta-key attack demonstrates the risks associated with compromised devices, particularly those running Windows. Once a device is infected and logged into a sensitive account, all data stored on it, including passkeys, is vulnerable to extraction. This highlights the importance of understanding the limitations of passkey technology and the need for robust security measures to protect sensitive data.
In conclusion, while the Pass-ta-key attack may not be novel, it serves as a reminder of the ongoing challenges in securing authentication methods. As passkeys continue to gain popularity, it is crucial to address the underlying security concerns and ensure that users can trust the technology to protect their data.
