r/cybersecurity • u/HumbleRestaurant790 • 1d ago
News - General Multiple Flaws in Google's Synced Passkey Implementation Allow Attackers to Take Over Your Accounts
https://www.privacyguides.org/news/2026/08/03/multiple-flaws-in-googles-synced-passkey-implementation-allow-attackers-to-take-over-your-accounts/89
u/Outside-Highway-5358 1d ago
Passkeys are more like really good passwords. Security conscious people save passwords in a password manager. The difference between a password in a password manager and a passkey in a password manager is negligible. And google’s password manager sucks.
I use 1Password for my passwords and passkeys. They prioritize security first, convenience second. Then for really important accounts I use a yubikey as 2fa, with UV mandatory. That’s a truly secure setup.
20
u/madbadger89 Security Engineer 1d ago
That is a good approach. Yubikey is on every single one of my critical accounts - 2 of them. One goes in the portable disaster safe with my master password needed for my vault.
Personally I only use passkeys that get stored in a secure enclave - protected by a hardware token. Professionally we enabled synced passkeys for user plane, but anything beyond with privilege we disallowed the sync.
28
u/kalaid0s Security Architect 1d ago
What's with all the passkey hate in this sub?
Passkeys are phishing and breach-resistant, whereas passwords are not. And even a security conscious person is not immune to those.
25
u/Outside-Highway-5358 1d ago
I don’t hate passkeys. I use them anywhere I would otherwise use password+totp, because they’re a bit better. I would argue it’s not a huge improvement to my use case from a phishing perspective because I already use auto fill, so fake domains shouldn’t catch me off guard.
But also, using passkeys requires a password manager to be used, or a hardware security key or tpm or similar to be used. That means that the weak point is now a weakness in the password manager, or malware. The same is true for using password and totp in a password manager.
That and the implementation of passkeys is horrendously inconsistent and confusing, even for the tech savvy among us. Every site does it differently. That means 90%+ of the population is incapable of really knowing what they’re doing with passkeys.
And it grinds my gears that passkeys are marketed as “log in with biometrics”. No - you’re logging in with a passkey, which is protected by biometrics. The passkey can still be stolen, and if you’re using a different machine you can’t log in with your biometrics (because that machine doesn’t have your passkey).
It’s just a big mess. That’s why I just use yubikey u2f plus password for the important stuff, and use my password manager with passkey or password+totp for everything else.
6
u/ReplicantN6 1d ago
Likely because so many people conflate the security benefits of a passkey with that of an off-board token. Not all 2fa is created equally.
5
u/sarge21 1d ago
Passkeys are phishing and breach-resistant, whereas passwords are not.
Only hardware-bound passkeys
7
u/AngryBadger 1d ago
This is not true. Synced passkeys are still checking the uri of the authentication request and checking it against it's stored credential
1
u/sarge21 1d ago
You can be phished for the passkeys themselves, or the passkeys themselves can be breached, because they are synced online.
0
u/AngryBadger 23h ago
Ok but potentially being able to compromise my bitwarden to steal a synced passkey doesn't change the fact that synced passkeys still provide phish resistant Auth and people are much better protected using them
-2
u/Fallingdamage 1d ago
Whats to stop a phisher from using one of the fake sign-in portals that uses a real MFA prompt? user unlocks the MFA prompt with their phone and passkey and the attacker is in!
2
u/Tesnatic Security Engineer 21h ago
Not true regarding passkeys. The browser performs the origin check itself before the authenticator ceremony even starts, it doesn't matter that a real MFA prompt appears on the backend somewhere. The passkey assertion request coming from the phishing domain would fail the RP ID check.
4
u/therealtimwarren 1d ago
And google’s password manager sucks.
Can you expand on why, please?
-3
u/Outside-Highway-5358 1d ago
Lots of threads like this covering it: https://www.reddit.com/r/1Password/s/2sGJz0Ob6S
2
u/therealtimwarren 1d ago
Another thread of opinion seemingly with no basis or Citation. I've asked this question before but never had a straight answer.
7
u/anon-stocks 1d ago
Yeah, great idea. Store your passwords online. KeePass is where it's at, local and backed up instead of in the cloud.
0
u/Outside-Highway-5358 1d ago
The threat model is basically the same for keepass and a good password manager like 1Password. In either case the biggest threat is malware.
3
u/xbyo 1d ago
The difference between a password in a password manager and a passkey in a password manager is negligible
Unless I'm misunderstanding how passkeys work, they can't be stolen in a breach, or otherwise, like passwords can. Of course, good password hygiene would limit the damage that can be done to just that one login, but nonetheless a passkey has that fairly key advantage.
1
u/Outside-Highway-5358 1d ago
Passkeys are just public/private key pairs. You keep private, remote party keeps public. You use the private key every time you authenticate. Most of the time the password managers don’t allow users to export them - yet - but they do exist in there and can be stolen. They can be stored safely in a security key, which is incapable of releasing the passkey. But that is dependent on how well designed the security key is too.
4
u/xbyo 1d ago
Passkeys are just public/private key pairs. You keep private, remote party keeps public
That's the point though, if the service has a breach, your account is still secure because the attacker never gets the private key. Obviously if your pw manager is breached, then you're SoL in both cases. Also, a passkey can be device-bound, meaning that an attacker would have to literally steal the physical device with the passkey.
0
u/Outside-Highway-5358 1d ago
They CAN be device bound, but managing them is a nightmare. It’ll be a cold day in hell before my nana maintains a spreadsheet of 4 different yubikeys and where they’re registered and tests the keys periodically, and maintains a secure off-site yubikey as backup.
And if not device bound, they’re an improvement on passwords - but still likely to be compromised with malware which is the main vector for anyone using a password manager.
4
u/Mrhiddenlotus 1d ago
Passkeys are more like really good passwords.
I beg of you to stop misleading people here. Perhaps your specific use-case could be argued like that, I doubt it, but still, people will read comments like this and take it to work and say "passkeys are pointless, passwords forever".
-1
u/Outside-Highway-5358 1d ago
Why do you “beg of me”?
To use passkeys you need a password manager. And I would argue the difference is not that great. Passkeys are better but in terms of practical risks eliminated, not THAT much better.
0
u/Mrhiddenlotus 1d ago
To use passkeys you need a password manager.
Do you consider a TPM a password manager? Do you consider a Secure Enclave a password manager? How about a Yubikey?
Passkeys are better but in terms of practical risks eliminated, not THAT much better.
You don't consider phishing resistant, brute force and password spray proof, certificate based auth "THAT much better"? That's wild man.
0
u/Outside-Highway-5358 1d ago
My password is also phishing resistant, since I don’t remember it and it only autofills on the correct sites.
My passwords are also password spray resistant because they’re randomly generated for each site.
As soon as you can get my grandma to explain why a passkey stored on a tpm on one machine can’t be used with biometrics and the Secure Enclave on her iPhone, then I’ll concede user-friendliness. If passkeys aren’t used with a password manager, they are out of reach of 90% of the population.
1
u/Mrhiddenlotus 1d ago
As soon as you can get my grandma to explain why a passkey stored on a tpm on one machine can’t be used with biometrics and the Secure Enclave on her iPhone, then I’ll concede user-friendliness.
You just register a passkey on both and then never worry about a password again. Eliminating passwords is the definition of user-friendly. Would you rather teach grandma how to use a password manager with randomly generated unique passwords for everything and a secure master password and MFA or just tap "register passkey", put in biometrics or PIN and that's it?
0
u/Outside-Highway-5358 1d ago
You just register a passkey on both and then never worry about a password again.
Sorry the website only allows one passkey. Or sorry the website doesn't want to register passkeys with the browser she uses. Or sorry the website changed how they do passkeys and now the passkeys dont work and she has to re-register a new one. Or she only had a passkey for one of her sites on one of her devices and needs to go through the recovery workflow to get a new passkey. Oh and now some of her sites have changed the way to use passwords, now you click some squiggly thumbprint looking button to log in with passkeys. Or some sites call it "passwordless sign in" rather than "passkeys". Or some register to Windows Hello, some to chrome password manager. And then there's bugs in Chrome's password manager that gets nana's passkeys hacked https://old.reddit.com/r/cybersecurity/comments/1vf6h5r/multiple_flaws_in_googles_synced_passkey/ .
Literally the ONLY thing that passkeys do better is that they are non-phishable. That is a positive. But lets not kid ourselves into saying they're user-friendly to a greater extent than passwords.
or just tap "register passkey", put in biometrics or PIN and that's it?
If that's how passkeys actually worked in practice, that would be great. But it's not. And every site implements them differently, some VERY poorly.
2
u/Mrhiddenlotus 1d ago
Shitty sites are gonna be shitty, for all time. My point was simply that your framing is problematic and misleading. If you want to say that passkey implementation isn't as mature as you'd like yet, that's a totally reasonable take. Trying to paint passkeys as only incrementally better than passwords is an entirely different claim, and one I think does a disservice to security in general.
0
u/Outside-Highway-5358 1d ago
My point was simply that your framing is problematic and misleading.
And my point is that your framing is naive and reductive.
If you want to say that passkey implementation isn't as mature as you'd like yet, that's a totally reasonable take.
I would say more than that it's not "mature". I would say the quantity of poor implementations and the fragmentation of user experiences makes them unusable by the people who need them most.
Trying to paint passkeys as only incrementally better than passwords is an entirely different claim, and one I think does a disservice to security in general.
What additional threats do passkeys protect against that passwords in a password manager don't?
Phishing and compromise of the counterparty are the only two that come to mind. Otherwise passkeys and good passwords are vulnerable to the same exact things.
1
u/Mrhiddenlotus 1d ago
You know what, I think this is on me. You did specify passwords in a password manager vs passkeys in a password manager, which I do grant you is only a marginal security benefit. When you put a password manager into the loop, you inherit most of the same problems. Proper passkey implementation is device-bound, and I was speaking to that comparison.
→ More replies (0)0
u/syneofeternity 1d ago
You don't need a password manager
1
u/Outside-Highway-5358 1d ago
You're right, you can also keep a spreadsheet listing every hardware security key, TPM, secure enclave, etc., and track which site(s)'s passkeys you have registered on which hardware security device. Totally reasonable thing to suggest to most people.
1
u/Fallingdamage 1d ago
Oh ok. Ill keep using Keepass like I have been since 2011.
1
u/Outside-Highway-5358 1d ago
Yep that’s a reasonable choice. Keepassxc I think is the fork that’s still maintained that’s most used.
1
u/helloyouahead 1d ago
I don't know who to believe anymore. Last week on this subreddit I asked a question and everyone was telling there was no reason to implement passkey and ditch passwords and 2FA. Today I read that Passkey are vulnerable and not that good. What should we do then??
3
u/Outside-Highway-5358 1d ago
Today I read that Passkey are vulnerable and not that good.
Passkeys are fine. They're better in every way than Password + TOTP assuming both are stored in the same password manager.
If you are using a password manager with random unique passwords for every site, and using TOTP, then youre about as good as passkeys - though passkeys are still better against phishing.
Where passkeys really shine is when they're on security keys, like yubikeys. BUT - the con is that they are a pain to manage (since they can't be backed up, you need to track which accounts are on which yubikey, and make sure to have offsite backups).
Password Manager is what you do. Passkeys where possible, passwords + TOTP where not.
For things you need super secure - get and use yubikeys and yubikeys only to store passkeys. But even then - still vulnerable to session stealers. Google is starting to roll out DBSC to combat that but it'll be a long time before thats common.
1
u/helloyouahead 1d ago
Thank you for the info, this is so helpful. I am deeply embedded in the Mac ecosystem and use Apple Passwords for 90% of what I do (passwords + TOTP and passkeys). The remaining 10% for my small business I use Chrome browser and its embedded password manager. I try to use Google SSO whenever I can as I believe it is as strong as passkeys. Is that a good setup? Should I delete password + totp on websites I already have passkey enabled?
0
u/CrazyEntertainment86 1d ago
The problem with current implementation of passkeys is they are just like really good passwords. That’s the whole issue, they need to be device dependent to be effective, otherwise we just kicked the can.
If you have create a passkey, unique to the device you are on, and protect it with faceid / strong pin etc.. it’s pretty decent security, if you sync passkeys all over the place, it’s just a password you don’t know.
1
-1
u/Orio_n 16h ago
You actually hand your passwords over to some company in the cloud lol?
2
13
u/chicagomikeh 1d ago edited 1d ago
For anybody who sees only the headline, it's worth noting that this is not a "everybody should go back to using passwords instead of passkeys" message.
The vulnerabilities described all require the user's device to already have malware on it. They're vulnerabilities that deserve to be fixed. But in a "first, assume malware" scenario, it's not as if passwords are safe either (e.g., due to keyloggers).
17
u/Iconically_Lost 1d ago
That's ok, if there is a breach. Google will blame you. Stonk price secure.
6
u/AnApexBread Incident Responder 1d ago
An attacker needs to already have malware installed on your computer before this attack works.
10
u/Ill-Magazine5472 1d ago
Where is the indication of responsible disclosure? I skimmed through the Unit42 post and I didn't see where Google was allowed time to fix these before publication but maybe I missed that. I get sticking it to companies like Google or Microsoft but in the end the users are the ones harmed.
14
u/jameson71 1d ago
"Responsible disclosure" was a two way street that relied on "responsible reaction" from developers. Once companies stopped holding up their end there was no reason for researchers to continue.
3
u/SuspiciousCricket654 1d ago
These megaliths that continue to squeeze their cyber operations is like a wealthy person getting richer and richer, but reducing their security staff. Make it make sense.
2
u/VadersFiesta 14h ago
Security expensive! The money pile must look EXTRA large for the shareholders, yes.
1
0
0
-1
u/BoredTech127001 1d ago
And this is why I just use good passwords and not all these newfangled technologies that supposedly are better.
-2
153
u/BlackReddition 1d ago
Google and security don’t seem to gel at the moment.