Malware can decrypt all Google passkeys synced on Windows, researchers warn

Full text

Credit: Calvin Wankhede / Android Authority

TL;DR

Security researchers at Palo Alto Networks’ Unit 42 discovered three malware attack paths targeting Google Password Manager’s synced passkeys on Windows PCs.

The attacks exploit device trust, onboarding, and recovery mechanisms rather than breaking passkey cryptography itself. The most severe technique, Golden Pass-ta-key, allows attackers to recover the master secret and decrypt all synced passkeys tied to an account.

Every attack requires malware to be running on the victim’s Windows PC, making endpoint security the biggest takeaway.

While most people may have heard of passkeys, many still don’t fully understand how they work . But according to new research, understanding what passkeys don’t protect you from may be just as important as understanding what they do.

Researchers from Palo Alto Networks’ Unit 42 (via Bleeping Computer ) uncovered three ways malware on a compromised Windows PC could abuse Google Password Manager’s synced passkeys by exploiting weaknesses in device trust and recovery, rather than breaking passkey cryptography itself.