Hackers find potential route around Google’s passwordless security

Google’s push to replace passwords with supposedly safer passkeys is facing a fresh security challenge after researchers uncovered attacks that could allow malware on compromised Windows computers to bypass protections designed to keep accounts secure.

Passkeys are used by more than 800 million people and are promoted by Google as a simpler and more secure alternative to conventional passwords. They rely on device-based authentication, including fingerprints, facial recognition or PINs.

But researchers at Palo Alto Networks’ Unit 42 have identified three attack techniques targeting the way Chrome, Google Password Manager and cloud synchronisation interact.

Dubbed “Pass-ta-key”, “Silver Pass-ta-key” and “Golden Pass-ta-key”, the attacks do not directly break passkey cryptography. Instead, they exploit weaknesses surrounding the systems that store, authenticate and synchronise passkeys.

The first attack can potentially allow malware to use Chrome’s trusted identity to generate an apparently legitimate login response. Unit 42 found that GitHub rejected the technique, while eBay initially failed to perform a critical verification check. eBay subsequently patched the vulnerability after researchers reported it.

The second attack is more persistent. “Silver Pass-ta-key” can force Chrome to register a new authentication key controlled by an attacker, potentially allowing access to continue even after the original malware has been removed.

The most serious technique, “Golden Pass-ta-key”, targets a 32-byte encryption secret known as the Security Domain Secret, which Google Password Manager uses to protect synchronised passkeys.

Researchers found circumstances in which malware could extract the secret from Chrome’s memory during registration or recovery.

That creates a particularly difficult problem because the secret cannot simply be revoked and replaced.

Google has begun rolling out fixes, including removing the secret from Chrome logs, although researchers say it can remain accessible in browser memory under certain conditions.

The findings underline a broader weakness in the passwordless revolution; strong authentication can still be undermined if the software surrounding it is compromised.