Passkeys are still right, here is the small print

· · Security

If you have moved your team onto passkeys, or you were about to, this is the week somebody will send you a headline saying passkeys are broken. They are not. But the small print just got longer, and you should know what it says before somebody asks you about it.

Back in April we wrote that the NCSC had made passkeys its default recommendation, with password plus two-step verification demoted to the fallback. That advice still stands. Here is what has been added to it.

What the researchers found

Palo Alto Networks' Unit 42 published three attacks against Google's synced passkeys, which it calls Pass-ta-key, Silver Pass-ta-key, and Golden Pass-ta-key. Between them they let an attacker sign in to a passkey-protected account with no fingerprint, no PIN, and nothing appearing on the victim's screen; install their own verification key so future logins look properly approved; and extract the 32-byte secret that protects every passkey synced to that account.

A passkey is the login method that replaces your password with a cryptographic key held by your device, unlocked with your fingerprint, face, or device PIN. "Synced" means Google holds a protected copy so the same passkey works on your phone and your laptop.

The critical detail, stated plainly by the researchers: none of this breaks the cryptography. The attacks go after the machinery around the key. How Chrome stores its device keys, how a device re-enrols itself after that state is lost, and whether the website you are signing into bothers to check that a human was actually verified.

The precondition that changes everything

Every one of these attacks starts from the same place: malware already running on the person's Windows machine, as an ordinary user.

That is not a small footnote. If an attacker is already executing code on your finance director's laptop, you have a serious problem before passkeys enter the conversation. The same position lets them read documents, watch what is typed, steal session cookies, and sit inside an authenticated browser session. A stolen password would have fallen out of that machine hours earlier.

So the honest reading is not "passkeys failed". It is that passkeys move the fight from the network to the device, and once you are on the device the advantage narrows. That is a meaningfully different claim from the headline, and it is the one worth repeating when somebody in your business asks whether the rollout was a mistake.

What this actually changes

Nothing about the decision to use passkeys. They still remove phishing, credential stuffing, password reuse, and the entire market in stolen password lists. Those are the attacks that actually hit smaller businesses week after week. Trading them away because a well-resourced research team found an endpoint-dependent attack would be a bad swap.

Something about where you spend the next hour. If your login security now depends on the device being clean, then the device being clean is your login security. For most businesses that means the dull, already-on-the-list work: keeping Windows and Chrome updated, making sure staff are not running as local administrator, and having something on the endpoint that would notice malware rather than assuming none is there.

Something about recovery. Two of the three attacks abuse enrolment and recovery, the process by which a new device is trusted. That is worth knowing when you decide how a member of staff gets back into their account after losing a laptop. Convenient recovery routes are convenient for everybody.

What to do this quarter

  • Carry on with passkeys. If a rollout is half-finished, finish it. This research is not a reason to stop.
  • Check nobody works as a local administrator day to day. This is the single control that most reduces what malware can reach, and it is free.
  • Make sure Chrome and Windows update themselves without waiting for someone to click. Both attacks assume an endpoint the attacker can already work on.
  • Decide how account recovery works before you need it, and make it a process a person approves rather than an automatic one.
  • Be ready for the question. If someone forwards you a "passkeys are broken" headline, the answer is: they are not, this needs malware already on the machine, and keeping machines clean was always the job.

How Steelwise can help

Working out whether your login setup and your device security actually match, rather than one propping up an assumption about the other, is the kind of review we do. Get in touch if you would like a look at yours.

Further reading

← All filings

We use cookies to understand how visitors use this site. More information.