Passkeys, the new authentication paradigm, have been hailed as a more secure alternative to password-based methods. However, a recent attack called Pass-ta-key has raised concerns among end users and security professionals. This attack, described by researcher Arie Olshtein, demonstrates how malware can extract passkeys stored in the Google Password Manager app (GPM) for Windows. The confusion surrounding this research highlights the importance of understanding the limitations of passkeys, especially on Windows devices.
The Pass-ta-key attack exploits the fact that passkeys are not exclusively stored in the trusted platform manager (TPM) as commonly believed. Instead, most platforms and third-party software store passkeys locally on the device, with the exception of Microsoft's Windows operating system. This local storage approach allows for easier syncing across devices, but it also introduces security risks.
One key difference between Windows and other platforms is the level of privilege granted to applications. Windows apps typically run with user privileges, whereas other platforms encourage restricted privileges by default. This means that malware on a Windows device can more easily access data used by separate apps, including passkeys. As a result, many third-party developers have opted for cloud-based storage of passkeys, ensuring end-to-end encryption.
The Pass-ta-key attack leverages malware's access to the Google account and, in some cases, the user or device key stored in the TPM. By masquerading as an iPhone, the infected Windows machine can trigger a synchronization capability in GPM, transferring stored passkeys to the compromised device. This attack highlights the vulnerability of Windows devices when infected with malware, as it can lead to the unauthorized access of sensitive data.
It's important to note that the Pass-ta-key attack is not a novel concept. The risk of malware accessing credentials and passwords has always been present, and it's a fact of life in computing security. The purpose of passkeys is to eliminate shared secrets that can be phished or obtained through server breaches, not to withstand physical attacks against devices. Therefore, the attack surface extends to any data requiring authentication for access.
In conclusion, while the Pass-ta-key attack may not be entirely novel, it serves as a reminder of the ongoing challenges in securing authentication methods. Users, especially those on Windows devices, should be aware of the potential risks associated with compromised devices and take appropriate measures to protect their sensitive information.
