New Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing-Resistant MFA

A security vulnerability has emerged that threatens the integrity of passkey systems, specifically those designed to be phishing-resistant. This development represents a significant shift in the threat landscape for users who have migrated from traditional passwords to passkeys for account security. The attacks target the very mechanisms intended to protect user identities from unauthorized access through cryptographic keys. Coverage of this development is appearing in specialized and generalist media. The Hacker News provides a detailed technical focus, explicitly stating that these attacks can recover synced private keys and undermine MFA that was previously considered phishing-resistant.

Simultaneously, GB News has highlighted the scale of the potential impact, reporting that researchers are warning that millions of Google accounts could be under attack due to these vulnerabilities. Both outlets emphasize that the security guarantees once associated with passkey adoption are now being challenged by these new methods of exploitation. To understand the significance of this trend, it is necessary to recognize that passkeys were implemented as a replacement for passwords to eliminate the risks associated with phishing. By using public-key cryptography, they were designed to ensure that a private key never leaves the user's device or a secure synchronization cloud. Because these new attacks can recover those synced private keys, the fundamental security premise of the technology is at risk.

This is particularly critical for Google accounts, where millions of users rely on these synchronized credentials for access to their personal data and connected services. Looking forward, the focus remains on the warnings issued by researchers regarding the vulnerability of Google accounts and the technical feasibility of bypassing MFA. The coverage does not yet specify a patch or a direct mitigation strategy provided by the affected service providers. Future developments will likely center on whether these attacks can be scaled further and how platforms like Google respond to the ability of attackers to recover private keys that were meant to be securely synced across devices.