Recent revelations have highlighted significant vulnerabilities in passkey systems, suggesting that even without breaking cryptographic security, attackers can exploit these systems. Three distinct research initiatives have shown methods to undermine passkey protections, leveraging existing flaws without directly cracking their underlying math.
Emerging Threats to Passkey Systems
Passkeys, designed to replace traditional passwords and resist phishing, have come under scrutiny. Researchers have demonstrated ways to reuse signed authentication materials exposed by Windows, manipulate cloud-synced passkeys via malware, and exploit Windows Hello for Business keys from compromised sessions. These findings reveal the fragile nature of the security surrounding passkeys.
SpecterOps uncovered a method to impersonate privileged users by exploiting signed authentication materials, bypassing multifactor authentication (MFA) without stealing private keys. Unit 42’s research on Google Password Manager revealed paths to recover private keys from synced passkeys. Additionally, researcher Dirk-jan Mollema showed how malware can utilize a hardware-bound Windows Hello key without requiring fresh user authentication.
Mitigation Strategies and Vendor Responses
The vulnerabilities have prompted different mitigation strategies. Microsoft’s response to a logging vulnerability in Windows, identified as CVE-2026-34348, includes a security update and mitigations for passkey relay assertions. The company emphasizes a Zero Trust security model and recommends phishing-resistant authentication methods to minimize risk.
Unit 42’s findings underscore the persistent threat posed by the Security Domain Secret in Google’s synced-passkey system. Despite Google’s efforts to secure the secret, its temporary presence during re-registration highlights ongoing security challenges. The lack of a mechanism to rotate or revoke this key exacerbates the risk.
Implications for Future Security Practices
These findings stress the importance of robust security practices beyond cryptographic strength. While passkeys offer an advanced layer of protection, their surrounding implementation can still be vulnerable. SpecterOps and Unit 42’s research demonstrates the need for stringent endpoint defenses and careful management of authentication flows.
For organizations relying on passkeys, it’s crucial to apply security updates promptly and ensure that user-verification requirements are effectively enforced. Monitoring for unusual authentication patterns, especially those involving Windows Hello for Business without a device identifier, can help detect potential breaches.
As Microsoft plans to phase out traditional SMS and voice authentication methods in favor of passkeys by 2027, the emphasis on getting implementation details right becomes more critical. The findings from these research efforts serve as a reminder that even the strongest cryptographic systems can be compromised if their implementation is flawed.
