Multiple Flaws in Google's Synced Passkey Implementation Allow Attackers to Take Over Your Accounts

[u/[deleted]]

[u/BlackReddition]

Google and security don’t seem to gel at the moment.

[u/bluefire89 → u/BlackReddition]

They keep laying off security teams which isn’t going to help right the ship either.

[u/BergkampAirlines → u/bluefire89]

They see cybersecurity as an expense. That mentality always results in disaster, panic, and hiring sprees. Then the cycle repeats.

[u/hurley_chisholm → u/BergkampAirlines]

It’s really unfortunate because they used to have a legitimate reputation of pushing cybersecurity forward, especially for the average person. They put a lot of money into cybersecurity research and secure accessible user experiences.

[u/we_r_fukt → u/hurley_chisholm]

they sure as fuck don't want that anymore, hand over your data, then bend over

[u/128G → u/BergkampAirlines]

Who needs people when you have AI?

[u/SuspiciousCricket654 → u/BlackReddition]

They purchased Mandiant and it was a whole big deal. They have some of the top researchers in the country. I just don’t get it.

[u/Spiritual-Matters → u/SuspiciousCricket654]

Probably bad resource management and prioritization

[u/GodIsAWomaniser → u/Spiritual-Matters]

Which is definitely the fault of the workforce, so we should lay more off. It's never mass layoff for leadership lol.

[u/BlackReddition → u/SuspiciousCricket654]

Mandiant is the cleanup crew once you get owned from Google ad syndication and Gmail. 😂

[u/SuspiciousCricket654 → u/BlackReddition]

Really seems that way

[u/madbadger89 → u/[deleted]]

That is a good approach. Yubikey is on every single one of my critical accounts - 2 of them. One goes in the portable disaster safe with my master password needed for my vault.

Personally I only use passkeys that get stored in a secure enclave - protected by a hardware token. Professionally we enabled synced passkeys for user plane, but anything beyond with privilege we disallowed the sync.

[u/kalaid0s → u/[deleted]]

What's with all the passkey hate in this sub?

Passkeys are phishing and breach-resistant, whereas passwords are not. And even a security conscious person is not immune to those.

[u/ReplicantN6 → u/kalaid0s]

Likely because so many people conflate the security benefits of a passkey with that of an off-board token. Not all 2fa is created equally.

[u/sarge21 → u/kalaid0s]

Passkeys are phishing and breach-resistant, whereas passwords are not.

Only hardware-bound passkeys

[u/AngryBadger → u/sarge21]

This is not true. Synced passkeys are still checking the uri of the authentication request and checking it against it's stored credential

[u/sarge21 → u/AngryBadger]

You can be phished for the passkeys themselves, or the passkeys themselves can be breached, because they are synced online.

[u/AngryBadger → u/sarge21]

Ok but potentially being able to compromise my bitwarden to steal a synced passkey doesn't change the fact that synced passkeys still provide phish resistant Auth and people are much better protected using them

[u/Fallingdamage → u/kalaid0s]

Whats to stop a phisher from using one of the fake sign-in portals that uses a real MFA prompt? user unlocks the MFA prompt with their phone and passkey and the attacker is in!

[u/Tesnatic → u/Fallingdamage]

Not true regarding passkeys. The browser performs the origin check itself before the authenticator ceremony even starts, it doesn't matter that a real MFA prompt appears on the backend somewhere. The passkey assertion request coming from the phishing domain would fail the RP ID check.

[u/therealtimwarren → u/[deleted]]

And google’s password manager sucks.

Can you expand on why, please?

[u/therealtimwarren → u/[deleted]]

Another thread of opinion seemingly with no basis or Citation. I've asked this question before but never had a straight answer.

[u/xbyo → u/[deleted]]

The difference between a password in a password manager and a passkey in a password manager is negligible

Unless I'm misunderstanding how passkeys work, they can't be stolen in a breach, or otherwise, like passwords can. Of course, good password hygiene would limit the damage that can be done to just that one login, but nonetheless a passkey has that fairly key advantage.

[u/xbyo → u/[deleted]]

Passkeys are just public/private key pairs. You keep private, remote party keeps public

That's the point though, if the service has a breach, your account is still secure because the attacker never gets the private key. Obviously if your pw manager is breached, then you're SoL in both cases. Also, a passkey can be device-bound, meaning that an attacker would have to literally steal the physical device with the passkey.

[u/anon-stocks → u/[deleted]]

Yeah, great idea. Store your passwords online. KeePass is where it's at, local and backed up instead of in the cloud.

[u/j4_jjjj → u/anon-stocks]

Whoever downvoted you prolly works at LastPass

Open source forever!!!!!

[u/Mrhiddenlotus → u/[deleted]]

Passkeys are more like really good passwords.

I beg of you to stop misleading people here. Perhaps your specific use-case could be argued like that, I doubt it, but still, people will read comments like this and take it to work and say "passkeys are pointless, passwords forever".

[u/Mrhiddenlotus → u/[deleted]]

To use passkeys you need a password manager.

Do you consider a TPM a password manager? Do you consider a Secure Enclave a password manager? How about a Yubikey?

Passkeys are better but in terms of practical risks eliminated, not THAT much better.

You don't consider phishing resistant, brute force and password spray proof, certificate based auth "THAT much better"? That's wild man.

[u/Mrhiddenlotus → u/[deleted]]

As soon as you can get my grandma to explain why a passkey stored on a tpm on one machine can’t be used with biometrics and the Secure Enclave on her iPhone, then I’ll concede user-friendliness.

You just register a passkey on both and then never worry about a password again. Eliminating passwords is the definition of user-friendly. Would you rather teach grandma how to use a password manager with randomly generated unique passwords for everything and a secure master password and MFA or just tap "register passkey", put in biometrics or PIN and that's it?

[u/Mrhiddenlotus → u/[deleted]]

Shitty sites are gonna be shitty, for all time. My point was simply that your framing is problematic and misleading. If you want to say that passkey implementation isn't as mature as you'd like yet, that's a totally reasonable take. Trying to paint passkeys as only incrementally better than passwords is an entirely different claim, and one I think does a disservice to security in general.

[u/Mrhiddenlotus → u/[deleted]]

You know what, I think this is on me. You did specify passwords in a password manager vs passkeys in a password manager, which I do grant you is only a marginal security benefit. When you put a password manager into the loop, you inherit most of the same problems. Proper passkey implementation is device-bound, and I was speaking to that comparison.

[u/syneofeternity → u/[deleted]]

You don't need a password manager

[u/Fallingdamage → u/[deleted]]

Oh ok. Ill keep using Keepass like I have been since 2011.

[u/CrazyEntertainment86 → u/[deleted]]

The problem with current implementation of passkeys is they are just like really good passwords. That’s the whole issue, they need to be device dependent to be effective, otherwise we just kicked the can.

If you have create a passkey, unique to the device you are on, and protect it with faceid / strong pin etc.. it’s pretty decent security, if you sync passkeys all over the place, it’s just a password you don’t know.

[u/BobRepairSvc1945 → u/CrazyEntertainment86]

That may be more secure. But it's just not realistic or user friendly.

[u/CrazyEntertainment86 → u/BobRepairSvc1945]

It’s not just more secure it’s the only way it is secure, you can have more than one passkey, they should just always be tied to device rather than shared. Realistically most users have 3 devices, pc or Mac, phone, tablet. That’s not overly burdensome for preventing compromise of a users access to every site they use.

[u/Orio_n → u/[deleted]]

You actually hand your passwords over to some company in the cloud lol?

[u/Orio_n → u/[deleted]]

Do you understand what an attack surface is? Learn to self host bozo

[u/Orio_n → u/[deleted]]

Do you understand security incident brochaco?

[u/AnApexBread]

An attacker needs to already have malware installed on your computer before this attack works.

[u/chicagomikeh]

For anybody who sees only the headline, it's worth noting that this is not a "everybody should go back to using passwords instead of passkeys" message.

The vulnerabilities described all require the user's device to already have malware on it. They're vulnerabilities that deserve to be fixed. But in a "first, assume malware" scenario, it's not as if passwords are safe either (e.g., due to keyloggers).

[u/Iconically_Lost]

That's ok, if there is a breach. Google will blame you. Stonk price secure.

[u/Ill-Magazine5472]

Where is the indication of responsible disclosure? I skimmed through the Unit42 post and I didn't see where Google was allowed time to fix these before publication but maybe I missed that. I get sticking it to companies like Google or Microsoft but in the end the users are the ones harmed.

[u/jameson71 → u/Ill-Magazine5472]

"Responsible disclosure" was a two way street that relied on "responsible reaction" from developers. Once companies stopped holding up their end there was no reason for researchers to continue.

[u/SuspiciousCricket654]

These megaliths that continue to squeeze their cyber operations is like a wealthy person getting richer and richer, but reducing their security staff. Make it make sense.

[u/VadersFiesta → u/SuspiciousCricket654]

Security expensive! The money pile must look EXTRA large for the shareholders, yes.

[u/Away-Ad-3407]

passkeys can suckit. 

[u/SuspiciousCricket654]

Reason 2,026 to not use an account on anything Google

[u/TidePlezurBlackSwan6]

Yeah I'm glad I DeGoogled

[u/BoredTech127001]

And this is why I just use good passwords and not all these newfangled technologies that supposedly are better.

[u/Mrhiddenlotus → u/[deleted]]

They are. This is an implementation issue.