Good for awareness but its not Novel at all. Its an incomplete, sensational and one sided PR by a given company
1. There is nothing novel about this, its a known behavior and has been in public domain for a while
2. The article talks about syncable passkeys, however it fails to bring into discussion about the concept of Backup eligible and Backup state which are core to this topic.
3. The core selling point for passkey is its phishing resistant capability which is not even discussed once in the article
4. The authenticator implementation gives a lot of flexibility to the party implementing it and it also creates a room for abuse. There is a trade off between usability (synching credential between devices) and security.
5. Its just a glorified managed password which is PHISHING RESISTANT so still a lot better choice than using passwords alone.
This is someone related to a major TPM pet peeve of mine: the TPM only really cares about global device state and has no concept that a device may be a multi-user system, have multiple processes with different security levels, have multiple tenants, etc.
For example, it really ought to be possible to seal a secret such that it can only be unsealed if PCRs have certain values (the usual TPM thing) and the requester of the unseal operation is tagged by the OS (software TCB) as having a certain identity. The latter part is entirely missing from the TPM spec. (The identity could be a hash of the process, just a UUID, or just about anything else as long as it was reasonably well associated with the process in question. Obviously there are subtleties here.)
If the TPM worked the way I wanted, an unprivileged process running alongside Chrome would be completely unable to use the TPM to pretend to be Chrome.
Wouldn’t that be the job of the software TCB to ensure only the appropriate user is given access (and prevent the user from accessing the TPM directly obviously)?
The TPM validates the state of the software TCB, and the software TCB validates the state of the lower layer, and so on.
> Wouldn’t that be the job of the software TCB to ensure only the appropriate user is given access (and prevent the user from accessing the TPM directly obviously)?
This only works with the current TPM design if there is one “appropriate user”.
The real world contains Chrome, BitLocker, various VMs and containers, etc. The TPM does not properly accommodate this world.
The primitives of a tpm ("observations", which in practice map to ca-signing keys of various levels of boot stage) are a very poor match for the real world. In order for them to be usefully consistent, you have to have consistent inputs. That means you can't observe the kernel itself, but instead you observe a key that signs a kernel. This is awful when it's Microsoft signing a series of kernels that advance one-way but the TPM doesn't actually ratchet to prevent downgrade attacks (and would be even worse if it did, because then you'd inevitably brick machines again and again). Instead you trust a long-lived CA and God help you when you need to rotate it.
It's even worse if you're self-hosting the signing, to the point that despite a ton of work put into making it safe and understood I wouldn't do it with the current design; a bare-state unlock is more predictable and reliable but I'll make sure to regularly exercise my backup key and header.
> having a virtual store for credentials that could be backed by whatever.
An OS can do this. But it’s extremely awkward for an OS to do so in a way that is itself TPM-backed without kludging something disgusting on top of the TPM2 formats using OS-managed state, severely restricted functionality, and probably losing compatibility with the broader TPM ecosystem.
It didn’t have to be this way. The TPM authorization format could have had a field like “OS-managed identity” that the OS’s TPM stack would validate. And maybe even cool features like a standardized way for the OS to measure an application and for the application to use those measurements in its authorization. But none of this exists.
I thought the point of storing secrets in hardware TPM and not giving them out into userspace (i.e. passkeys instead of passwords) is protecting against malware as well.
And they claim that for Chrome on Windows:
> Unlike a legitimate user flow that requires user interaction and device unlock, this attack shows how malware can obtain the required signature silently, without user consent, biometrics, device unlock or elevated privileges.
>I thought the point of storing secrets in hardware TPM and not giving them out into userspace (i.e. passkeys instead of passwords) is protecting against malware as well.
This was never a design goal of passkeys as far as I'm aware, and normally passkeys are not generated or stored in a TPM. The primary design goal of passkeys was to make a phishing-resistant primary factor that could compete with the user experience and convenience of passwords, so that folks would actually be interested in using them.
I think you are thinking of security keys, which generate key material in e.g. a YubiKey which offer similar protections to a TPM.
YubiKeys can also be used to generate/store passkeys, but when they are used for passkeys typically they'd be referred to as "device-bound passkeys" rather than just "passkeys".
Boy I’m so tired of people trying to make clever attack names. They don’t help remember things, there are too many.
So all 3 “pass-ta-key” attacks are not attacks on passkeys, they’re attacks on the Google vault.
And if you get access to the vault, then you get everything. OK. And if you get access to a synced traditional password vault, then you get everything.
So… meh. These are bugs, they will be fixed. Good on them for disclosing them. But this does not prove that passkeys are terrible. This does not make them less secure than random passwords.
If it wasn’t for the fact that they just happen to be getting passkeys, seems like this wouldn’t be worth a headline or discussing at all. And if they have this level of access, then they also get all the standard password credentials in the vault too, right?
To my understanding both Apple Passwords and the Android equivalent allow you to
export passkeys to a different app (password manager), but I haven’t tried it yet.
If anyone has direct experience I appreciate to know how it was.
I had a click around Apple Passwords on macos and I could not find a way to move my passkeys to another app. I could only see a way to share them with other Apple Passwords users.
Those are the right questions: While I'd personally prefer full copy/import/export control, having the ability to set up an second key in advance is functionally-similar to having a backup of the first one. If I had my 'druthers:
1. All sites/services would allow the registration of 5 or more keys, which can be tracked/revoked separately. That way if one device is stolen, you can invalidate that key without affecting others.
2. There are two sets of keys: "Regular Use" and "Backup/Recovery".
3. Attempting to use a Backup/Recovery key prompts to user to confirm that they want to invalidate the Regular keys and promote the backup key(s) to the new regular. In this way, a compromised backup cannot be used in secret.
It's not functionally equivalent, but it is a workaround, but requires doing it on every site (if they allow it) and it cannot be freely moved and re-backed up offline from the site.
The actual reason is people have many devices. I assume this is at least somewhat common, but I still avoid passkeys so IDK.
You're designing a system where we should just be able to backup our own keys if we want to.
Also, can I add a backup key without having the private key with me? Ideally I would like to keep a master key in a vault, to recover compromised accounts and such, but requiring me to load the master key to create every account prevents truly secure storage.
It's ao comically bad it proves the while thing is a joke unless you're trusting Apple or Google to sync and back them up for you. One cynical angle at why the backup is being slow-rolled is because the major players have an incentive to not do it. They want you dependent on them and locked into their ecosystem.
It's completely insane to treat a credential to an account as something that cannot be backed up. It implies there's another form of recovery, which likely means that key is only as secure as the other recovery options. And when it comes all the way back to the master key to your manager itself the loop falls somewhat apart.
It's a hard problem, but passkeys aren't ready for me yet.
>They want you dependent on them and locked into their ecosystem.
This is a strange conclusion to come to when clearly a lot of effort was put into developing an open standard (Credential Exchange Format) to make it easy and secure to move credentials between vendors/ecosystems, without opening end-users up to phishing attacks on credential export.
If big tech wanted to lock people in, it seems like it would have been a lot easier to just... not create an open standard.
> And if you get access to the vault, then you get everything. OK. And if you get access to a synced traditional password vault, then you get everything.
No? It’s why 2FA exists. I have an email with password of 5 characters only and the password leaked decade ago, never changed it and no one accessed it because it has 2fa. I can share my whole password vault and I would not care about it because it’s useless without 2fa. Not the case with passkey, glad I never set it up on any of my accounts, pass+mfa is good for 99% of accounts (not sms obviously), rest are public private keys.
Majority of second factors are phishable. If you are using a password (phishable) + a phishable second factor (any kind of 6 digit code that you need to type or paste into a text box), you are less secure than if you were using only a passkey.
>4. Using the hash of that handshake, the attacker interacts with the victim’s TPM and uses the extracted identity key to sign the handshake hash together with the assertion request
Huh? If you have this level of local privileges you can just read session cookies from the browsers store? I guess stealing all the keys is notable, but you can manipulate any password manager with this level of access right?
What's the threat model here, that synced passkeys should be secure in even in situations involving compromised clients? How?
>that synced passkeys should be secure in even in situations involving compromised clients?
I think that is the idea actually. By using secure hardware features it is in theory possible to secure the passkeys even in the case of compromised clients. Like how the iphone uses a security coprocessor to store the decryption keys and face id info out of the reach of iOS.
But this isn't overly concerning since it's still at a minimum as secure as passwords in a local compromise situation.
This is how I assumed it worked as well.
I wasn't aware of the non User Verification method.
I thought the passkey was tied to hardware.
I thought that was the entire point.
How wrong I was it seems.
As far as I can tell, Passkeys is just like ssh keys for normal people. But there's a lot of implementation details which get confused with the base specification. They can be tied to hardware, they can be stored on a secure zone that malware can't reach, but at the core they are pretty much just a pub/private key pair.
It's not that simple. The stolen file has no clear text passwords and ideally, these passwords can only be decrypted on the right hardware with user confirmation. Of course, eternal and repeated confirmation requests are an anti pattern all their own, but the cloud attestation service not verifying the hardware sounds like a really glaring omission.
It kinda is. If they use Chrome and it's cloud backed password manager, odds are they use GMail. That plus full access to a trusted device (which you have in this scenario) allows you to change their Google account password. Boom, full persistence.
I can think of at least a dozen easier ways to do nefarious things with this level of access that are at least that simple. As an example, faking user attribution would be trivial.
How could Google patch this? If the client is compromised and the attacker can manipulate the local TPM or it's equivalent there's no defense.
At least for accounts you want to keep very secure, session cookies are probably very time-limited. Stealing a passkey ensures persistent access in the future.
But I largely agree, if they're able to do this on your system you're already hacked and they can do a ton of very bad things.
It seems like I have to trust more things that aren't very intuitive and are out of my control for passkeys to really be secure. For passwords, I only need to trust myself. I trust that I don't lose them, don't re-use them, and don't fall for phishing attacks.
Of course I also have to trust that whatever service I'm authenticating to does their part correctly, but that's the same either way.
This is an insane and uninformed take. The malware described in TFA can even more trivially harvest passwords, which have never lived in a TPM. Passwords offer no security benefit over passkeys.
Good for awareness but its not Novel at all. Its an incomplete, sensational and one sided PR by a given company
1. There is nothing novel about this, its a known behavior and has been in public domain for a while
2. The article talks about syncable passkeys, however it fails to bring into discussion about the concept of Backup eligible and Backup state which are core to this topic.
3. The core selling point for passkey is its phishing resistant capability which is not even discussed once in the article
4. The authenticator implementation gives a lot of flexibility to the party implementing it and it also creates a room for abuse. There is a trade off between usability (synching credential between devices) and security.
5. Its just a glorified managed password which is PHISHING RESISTANT so still a lot better choice than using passwords alone.
This is someone related to a major TPM pet peeve of mine: the TPM only really cares about global device state and has no concept that a device may be a multi-user system, have multiple processes with different security levels, have multiple tenants, etc.
For example, it really ought to be possible to seal a secret such that it can only be unsealed if PCRs have certain values (the usual TPM thing) and the requester of the unseal operation is tagged by the OS (software TCB) as having a certain identity. The latter part is entirely missing from the TPM spec. (The identity could be a hash of the process, just a UUID, or just about anything else as long as it was reasonably well associated with the process in question. Obviously there are subtleties here.)
If the TPM worked the way I wanted, an unprivileged process running alongside Chrome would be completely unable to use the TPM to pretend to be Chrome.
Wouldn’t that be the job of the software TCB to ensure only the appropriate user is given access (and prevent the user from accessing the TPM directly obviously)?
The TPM validates the state of the software TCB, and the software TCB validates the state of the lower layer, and so on.
> Wouldn’t that be the job of the software TCB to ensure only the appropriate user is given access (and prevent the user from accessing the TPM directly obviously)?
This only works with the current TPM design if there is one “appropriate user”.
The real world contains Chrome, BitLocker, various VMs and containers, etc. The TPM does not properly accommodate this world.
Ugh?
I thought application talks to the OS and the OS that check before it do the TPM thing.
The primitives of a tpm ("observations", which in practice map to ca-signing keys of various levels of boot stage) are a very poor match for the real world. In order for them to be usefully consistent, you have to have consistent inputs. That means you can't observe the kernel itself, but instead you observe a key that signs a kernel. This is awful when it's Microsoft signing a series of kernels that advance one-way but the TPM doesn't actually ratchet to prevent downgrade attacks (and would be even worse if it did, because then you'd inevitably brick machines again and again). Instead you trust a long-lived CA and God help you when you need to rotate it.
It's even worse if you're self-hosting the signing, to the point that despite a ton of work put into making it safe and understood I wouldn't do it with the current design; a bare-state unlock is more predictable and reliable but I'll make sure to regularly exercise my backup key and header.
I'm not even sure why OS exposes TPM directly to applications instead of having a virtual store for credentials that could be backed by whatever.
UPD. nvm, that's not what's happening
> having a virtual store for credentials that could be backed by whatever.
An OS can do this. But it’s extremely awkward for an OS to do so in a way that is itself TPM-backed without kludging something disgusting on top of the TPM2 formats using OS-managed state, severely restricted functionality, and probably losing compatibility with the broader TPM ecosystem.
It didn’t have to be this way. The TPM authorization format could have had a field like “OS-managed identity” that the OS’s TPM stack would validate. And maybe even cool features like a standardized way for the OS to measure an application and for the application to use those measurements in its authorization. But none of this exists.
These are endpoint malware attacks, not attacks on Passkeys per se. This is already a game-over position for an attacker to be in.
I thought the point of storing secrets in hardware TPM and not giving them out into userspace (i.e. passkeys instead of passwords) is protecting against malware as well.
And they claim that for Chrome on Windows:
> Unlike a legitimate user flow that requires user interaction and device unlock, this attack shows how malware can obtain the required signature silently, without user consent, biometrics, device unlock or elevated privileges.
>I thought the point of storing secrets in hardware TPM and not giving them out into userspace (i.e. passkeys instead of passwords) is protecting against malware as well.
This was never a design goal of passkeys as far as I'm aware, and normally passkeys are not generated or stored in a TPM. The primary design goal of passkeys was to make a phishing-resistant primary factor that could compete with the user experience and convenience of passwords, so that folks would actually be interested in using them.
I think you are thinking of security keys, which generate key material in e.g. a YubiKey which offer similar protections to a TPM.
YubiKeys can also be used to generate/store passkeys, but when they are used for passkeys typically they'd be referred to as "device-bound passkeys" rather than just "passkeys".
Yes, there's no security bug here of any kind. The "novel attack surface" already assumes the attacker can execute code as your user.
Boy I’m so tired of people trying to make clever attack names. They don’t help remember things, there are too many.
So all 3 “pass-ta-key” attacks are not attacks on passkeys, they’re attacks on the Google vault.
And if you get access to the vault, then you get everything. OK. And if you get access to a synced traditional password vault, then you get everything.
So… meh. These are bugs, they will be fixed. Good on them for disclosing them. But this does not prove that passkeys are terrible. This does not make them less secure than random passwords.
If it wasn’t for the fact that they just happen to be getting passkeys, seems like this wouldn’t be worth a headline or discussing at all. And if they have this level of access, then they also get all the standard password credentials in the vault too, right?
Have we standardized a way to backup and export passkeys yet? Do websites commonly allow multiple passkeys to be registered?
There’s FIDO CXF/CXP: https://fidoalliance.org/specs/cx/cxf-v1.0-ps-errata-2026030...
To my understanding both Apple Passwords and the Android equivalent allow you to export passkeys to a different app (password manager), but I haven’t tried it yet.
If anyone has direct experience I appreciate to know how it was.
I had a click around Apple Passwords on macos and I could not find a way to move my passkeys to another app. I could only see a way to share them with other Apple Passwords users.
I can confirm it works on iOS 27. I haven’t tried elsewhere though
I think it’s a 27 feature.
Those are the right questions: While I'd personally prefer full copy/import/export control, having the ability to set up an second key in advance is functionally-similar to having a backup of the first one. If I had my 'druthers:
1. All sites/services would allow the registration of 5 or more keys, which can be tracked/revoked separately. That way if one device is stolen, you can invalidate that key without affecting others.
2. There are two sets of keys: "Regular Use" and "Backup/Recovery".
3. Attempting to use a Backup/Recovery key prompts to user to confirm that they want to invalidate the Regular keys and promote the backup key(s) to the new regular. In this way, a compromised backup cannot be used in secret.
It's not functionally equivalent, but it is a workaround, but requires doing it on every site (if they allow it) and it cannot be freely moved and re-backed up offline from the site.
The actual reason is people have many devices. I assume this is at least somewhat common, but I still avoid passkeys so IDK.
You're designing a system where we should just be able to backup our own keys if we want to.
Also, can I add a backup key without having the private key with me? Ideally I would like to keep a master key in a vault, to recover compromised accounts and such, but requiring me to load the master key to create every account prevents truly secure storage.
From account security POV, it is better to disallow backup or export passkeys. Each device should get their unique key.
This would be quite bad from usability or privacy pov, I guess.
It's ao comically bad it proves the while thing is a joke unless you're trusting Apple or Google to sync and back them up for you. One cynical angle at why the backup is being slow-rolled is because the major players have an incentive to not do it. They want you dependent on them and locked into their ecosystem.
It's completely insane to treat a credential to an account as something that cannot be backed up. It implies there's another form of recovery, which likely means that key is only as secure as the other recovery options. And when it comes all the way back to the master key to your manager itself the loop falls somewhat apart.
It's a hard problem, but passkeys aren't ready for me yet.
>They want you dependent on them and locked into their ecosystem.
This is a strange conclusion to come to when clearly a lot of effort was put into developing an open standard (Credential Exchange Format) to make it easy and secure to move credentials between vendors/ecosystems, without opening end-users up to phishing attacks on credential export.
If big tech wanted to lock people in, it seems like it would have been a lot easier to just... not create an open standard.
> backup / export
Last I heard this was a major point of contention between two groups, and last I checked, both had extremely valid concerns.
> Multiple passkeys
I commonly have two software and two hardware keys registered per site.
> And if you get access to the vault, then you get everything. OK. And if you get access to a synced traditional password vault, then you get everything.
No? It’s why 2FA exists. I have an email with password of 5 characters only and the password leaked decade ago, never changed it and no one accessed it because it has 2fa. I can share my whole password vault and I would not care about it because it’s useless without 2fa. Not the case with passkey, glad I never set it up on any of my accounts, pass+mfa is good for 99% of accounts (not sms obviously), rest are public private keys.
Majority of second factors are phishable. If you are using a password (phishable) + a phishable second factor (any kind of 6 digit code that you need to type or paste into a text box), you are less secure than if you were using only a passkey.
There is nothing stopping people from using passkeys with MFA. I’ve seen them do it. It’s against the suggestion, but they can do it.
>4. Using the hash of that handshake, the attacker interacts with the victim’s TPM and uses the extracted identity key to sign the handshake hash together with the assertion request
Huh? If you have this level of local privileges you can just read session cookies from the browsers store? I guess stealing all the keys is notable, but you can manipulate any password manager with this level of access right?
What's the threat model here, that synced passkeys should be secure in even in situations involving compromised clients? How?
>that synced passkeys should be secure in even in situations involving compromised clients?
I think that is the idea actually. By using secure hardware features it is in theory possible to secure the passkeys even in the case of compromised clients. Like how the iphone uses a security coprocessor to store the decryption keys and face id info out of the reach of iOS.
But this isn't overly concerning since it's still at a minimum as secure as passwords in a local compromise situation.
This is how I assumed it worked as well. I wasn't aware of the non User Verification method. I thought the passkey was tied to hardware. I thought that was the entire point. How wrong I was it seems.
As far as I can tell, Passkeys is just like ssh keys for normal people. But there's a lot of implementation details which get confused with the base specification. They can be tied to hardware, they can be stored on a secure zone that malware can't reach, but at the core they are pretty much just a pub/private key pair.
It's not that simple. The stolen file has no clear text passwords and ideally, these passwords can only be decrypted on the right hardware with user confirmation. Of course, eternal and repeated confirmation requests are an anti pattern all their own, but the cloud attestation service not verifying the hardware sounds like a really glaring omission.
It kinda is. If they use Chrome and it's cloud backed password manager, odds are they use GMail. That plus full access to a trusted device (which you have in this scenario) allows you to change their Google account password. Boom, full persistence.
I can think of at least a dozen easier ways to do nefarious things with this level of access that are at least that simple. As an example, faking user attribution would be trivial.
How could Google patch this? If the client is compromised and the attacker can manipulate the local TPM or it's equivalent there's no defense.
At least for accounts you want to keep very secure, session cookies are probably very time-limited. Stealing a passkey ensures persistent access in the future.
But I largely agree, if they're able to do this on your system you're already hacked and they can do a ton of very bad things.
It seems like I have to trust more things that aren't very intuitive and are out of my control for passkeys to really be secure. For passwords, I only need to trust myself. I trust that I don't lose them, don't re-use them, and don't fall for phishing attacks.
Of course I also have to trust that whatever service I'm authenticating to does their part correctly, but that's the same either way.
I'm going to continue to use passwords.
This is an insane and uninformed take. The malware described in TFA can even more trivially harvest passwords, which have never lived in a TPM. Passwords offer no security benefit over passkeys.
"You must enable DRM to play some audio or video on this page" pops up in the strangest places...
"Oh no, someone might pirate my advertisement, and show it make even more people see it for free!"
It is hard to find the content for all of the glitzy ads on this site.
There's ads?
But when you do, there are glaring holes these people uncovered.