Breaking Lab srl
Three independent research efforts have demonstrated ways to defeat passkey protections without breaking their underlying cryptography. The findings cast doubt on the widely held belief that passkeys are a near-perfect defence against phishing.
Unit 42 researchers have detailed three attack paths that allow ordinary user-level malware on Windows to silently sign into passkey-protected accounts via Google Password Manager. The findings raise serious questions about passkeys as a silver-bullet authentication solution.
Researchers at Unit 42 have uncovered three attack paths that allow malware on a compromised Windows machine to silently abuse Google Password Manager's synced passkeys. The findings cast serious doubt on passkeys as an unbreakable authentication solution.
