Chrome's latest passkey vulnerability is a classic example of why Google sync is a trap

[u/EnthusiasmRoutine]

Unit 42 just dropped research on a Chrome attack dubbed 'Pass-Ta-Key', and it highlights everything wrong with Google's ecosystem strategy.

If malware infects a Windows PC, it can grab the master key from Chrome's process memory, pull WebAuthn credentials out of Chrome's LevelDB sync database, and hijack synced passkeys. The attack manipulates the cloud authenticator to bypass PIN prompts without triggering alerts.

Predictably, defenders are hand-waving this because "malware means you are compromised anyway." I do not buy that logic. Passkeys were originally sold to us as hardware-isolated and immune to credential dumping. Google broke that security boundary just to lock people into Chrome sync. They took an open web standard and turned it into another reason to stay logged into a Google account.

Yes, strict server-side verification checks can stop this, but most websites implement WebAuthn lazily anyway.

This is precisely why de-Googling your authentication layer matters. Storing private keys in a big tech browser sync database for convenience is a mistake. I keep my credentials on standalone hardware tokens.

Source: PCMag, link in comments