Pass the Passkey: A Novel Attack Surface in Passwordless Authentication
3 hours ago
- Passkeys replace passwords and MFA using public-key cryptography, reducing credential theft but introducing new attack surfaces.
- Three novel attacks (Pass-ta-key, Silver, Golden) exploit gaps in Google's synced passkey ecosystem on Windows via endpoint malware.
- Pass-ta-key attack: Malware uses the device identity key to silently sign authentication requests, bypassing user interaction and device unlock.
- Silver Pass-ta-key attack: Attacker invalidates existing user verification key and registers a forged key, enabling reusable, remote account takeover without victim's device.
- Golden Pass-ta-key attack: Attacker extracts the security domain secret (SDS) from Chrome memory to decrypt all synced passkeys indefinitely.
- Relying parties must enforce strict UV flag validation, and credential managers should harden recovery flows, limit access to local passkey data, and prevent exposure of key material.