Latest / The Digital Warfare Podcast / Digital Warfare Podcast Daily Brief #141 August 04, 2026
Transcript
- Digital Warfare: You're listening to the Digital Warfare Podcast. Today, we are covering new research that challenges one of the strongest assumptions in modern identity security: that passkeys cannot be stolen, copied, or reused like passwords. The key issue is not a weakness in public key cryptography. It is the trust placed in the endpoint, the browser, and the recovery process surrounding the credential. Here's what happened. Security researchers demonstrated three attack techniques against Google Password Manager's synced passkeys in Chrome on Windows devices equipped with a trusted platform module. The attacks are collectively known as pass to key. All three require malware to be running on the victim's computer first. This is not a remote attack against an uncompromised device, and researchers have not reported active exploitation in the wild. But once malware is present, the attacks show that passkey protected accounts may still be exposed. The first technique allows unprivileged malware to impersonate the victim's trusted device. Chrome uses a hardware-backed identity key to prove that an authentication request originated from a recognized computer. Malware can access the wrapped form of that key and use standard Windows cryptographic functions to request a valid signature. Google's Cloud Authenticator then sees what appears to be a legitimate trusted device and returns a valid authentication assertion. The attack can occur without administrator rights, device unlock, biometrics, or user interaction. However, it may fail when the target service requires user verification and correctly validates the user verified flag. The researchers found that not every service performed that validation correctly. The second technique, called silver pasta key, goes further. The attacker forces Chrome to re-register the device and then inserts an attacker-controlled user verification key during the onboarding process. Once registered, that key is treated as proof that the victim unlocked the device with a pin or biometric. The attacker can then authenticate from another system without needing continued access to the infected computer. The third technique, golden pasta key, Creates the greatest long-term risk. Google Password Manager uses a master key called the Security Domain Secret to encrypt synced passkeys. During device registration or recovery, that secret is temporarily sent to Chrome. Researchers initially found it exposed in browser logs. Google removed it from those logs, but the secret reportedly remains temporarily accessible in Chrome's process memory. Malware monitoring that process may extract the master key, decrypt synchronized passkey records, and recover the private keys. Those keys can then be transferred and used from another system. The stolen master key may also expose pass keys created in the future because the current design reportedly provides no direct mechanism to rotate or revoke it. The defensive response begins with endpoint security. Pass keys reduce phishing and password reuse risk, but they do not neutralize malware already operating as the user. Organizations should strengthen endpoint detection, restrict untrusted applications, protect browser data. And monitor for unexpected passkey recovery or device re-registration activity. Services implementing passkeys must require user verification and validate the user-verified flag rather than assuming the presence of a valid cryptographic assertion proves the user was involved. Security teams should also investigate unexpected recovery pin prompts, modifications to Chrome passkey state, unusual device enrollment, and passkey authentication from unfamiliar systems. The strategic lesson is direct. Passwordless does not mean attackless. Pass keys remove the shared secret, but the surrounding system still depends on device trust, recovery workflows, browser memory, and correct validation. When the endpoint is compromised, attackers do not need to break the cryptography, they only need to manipulate the system trusted to use it. This has been your Digital Warfare Daily Brief. Stay secure, we'll see you tomorrow.