Executive Summary
Recent threat research has identified a novel attack surface in Google’s synced passkey ecosystem, dubbed 'Pass-ta-key.' While passkeys eliminate shared secrets like passwords, current implementations for cross-device synchronization introduce new vulnerabilities. Researchers demonstrated that unprivileged malware on a compromised endpoint can misuse hardware-backed keys to authenticate without user interaction, bypass user verification (UV) requirements, and extract the Security Domain Secret (SDS) master key.
The research highlights three primary attack vectors: the standard Pass-ta-key attack (device identity impersonation), the Silver Pass-ta-key (forgery of UV keys during onboarding), and the Golden Pass-ta-key (extraction of the SDS from memory to decrypt all synced credentials). These findings challenge the assumption that passkeys are inherently immune to credential theft, particularly when endpoints are compromised.
Failure to properly validate the User Verified (UV) flag by Relying Parties (RPs) and the exposure of master keys in client process memory remain critical gaps. Organizations should ensure their authentication providers strictly enforce hardware-backed attestation and validate UV signals to prevent these automated account takeover scenarios.