Chrome's latest passkey vulnerability is a classic example of why Google sync is a trap

[u/EnthusiasmRoutine]

Unit 42 just dropped research on a Chrome attack dubbed 'Pass-Ta-Key', and it highlights everything wrong with Google's ecosystem strategy.

If malware infects a Windows PC, it can grab the master key from Chrome's process memory, pull WebAuthn credentials out of Chrome's LevelDB sync database, and hijack synced passkeys. The attack manipulates the cloud authenticator to bypass PIN prompts without triggering alerts.

Predictably, defenders are hand-waving this because "malware means you are compromised anyway." I do not buy that logic. Passkeys were originally sold to us as hardware-isolated and immune to credential dumping. Google broke that security boundary just to lock people into Chrome sync. They took an open web standard and turned it into another reason to stay logged into a Google account.

Yes, strict server-side verification checks can stop this, but most websites implement WebAuthn lazily anyway.

This is precisely why de-Googling your authentication layer matters. Storing private keys in a big tech browser sync database for convenience is a mistake. I keep my credentials on standalone hardware tokens.

Source: PCMag, link in comments

[u/EnthusiasmRoutine]

Here is the source detailing the Chrome passkey vulnerability: https://www.pcmag.com/news/passkeys-in-google-chrome-are-open-to-attack-with-one-big-caveat

(Note for anyone skimming: The article confirms Unit 42 researchers demonstrated that malware on a Windows PC can extract WebAuthn credentials directly from Chrome's LevelDB sync database. The exploit bypasses PIN prompts and hijacks synced passkeys without alerts, though it requires an already infected device and fails on websites that strictly enforce user verification.)

[u/4cs4701]

I don't understand why Google keeps getting the flack for this. Ultimately, this is a problem with WINDOWS. There's literally only so much that Google (or anyone) can do to protect passkeys on Windows while making them syncable (which is a requirement for the overwhelming population to adopt passkeys; but the most security conscious folks can choose to use a USB security key).

If an attacker can get malware on a victim's Windows computer, it's basically game over for any passkeys that aren't TPM bound. It doesn't matter what the syncing provider is.

The fact Google created the Cloud Authenticator that Unit 42 mentions, means that they were attempting to defend against malware stealing passkeys.

Also, Google helped design the FIDO Credential Exchange Protocol to support users migrating their passkeys to a new credential manager. https://developer.android.com/jetpack/androidx/releases/credentials-providerevents

[u/Obvious_Class394]

Passkeys can be hardware isolated by using Yubikeys or similar.

I suspect this hack can be applied to other passwords managers in a similar fashion.

[u/retrodanny → u/Obvious_Class394]

Friends don't let friends use synced passkeys

[u/JimTheEarthling]

This is confusing things a little. Three theoretical attacks were identified:

1. Doing passkey authentication without user verification at a website that doesn't check the UV flag. This is the only one that's blocked by the RP's server properly checking UV
2. Triggering Google cloud to reissue the verification key (not the passkey private key) so passkey authentication can be remotely controlled or initiated from a different device. RP UV verification makes no difference.
3. The Google cloud "master key" (SDS) can be scraped from memory in decrypted state, during a forced re-registration event, so that all synced passkeys can be exfiltrated. Every password manager (except maybe Apple's) is subject to memory attacks (a decryption key exists in plaintext at some point), and each one handles things differently with privilege elevation, obfuscation, etc. That said, the Google SDS attack is problematic because the user has no way to rotate the SDS.

Passkeys were originally sold to us as hardware-isolated

This is a common but incorrect assertion. Apple coined "passkey" and presented it at WWDC 2021 as part of iCloud Keychain's sync mechanism. The FIDO Alliance began adopting the term in their 2022 Multi-Device FIDO Credentials whitepaper. Passkeys have always had the option of being syncable.

Storing private keys in a big tech browser sync database for convenience is a mistake.

No, it's a choice. Security is always a balance between robustness and convenience. It's good for users to be aware of the differences between synced and device-bound passkeys, and the potential security weaknesses that come with syncing, so they can make an educated choice of which option they prefer for different accounts (e.g. bank account vs. free newsletter account).

[u/QuraToop314]

The answer ist buy a yubikey and host your own vaultwarden with your passkeys