**Understanding Passkey Bypass Risks: Recent Findings and Mitigations**
Passkeys have been widely promoted as a more secure alternative to traditional passwords, designed to replace reusable credentials and resist phishing attacks. However, last week brought new research highlighting that passkey protections can still be bypassed—not by breaking the cryptography itself, but by exploiting weaknesses in how systems handle signed authentication material, cloud syncing, and session keys.
—
### Recent Research Findings
Three distinct research efforts revealed different methods to compromise passkey-based authentication:
1. **SpecterOps** demonstrated a Windows and Microsoft Entra ID attack chain that allows privileged user impersonation. By reusing signed authentication material stored in cleartext, attackers can bypass phishing-resistant multifactor authentication protections. This vulnerability is tied to a Windows Event Logging Service flaw tracked as **CVE-2026-34348**.
2. **Unit 42** focused on Google Password Manager in Chrome. They showed that malware already running on a victim’s machine can recover the Security Domain Secret—a master key protecting synced passkeys—allowing attackers to extract private keys associated with synced credentials.
3. **Independent researcher Dirk-jan Mollema** proved that malware running within an already compromised Windows session can leverage Windows Hello for Business keys without requiring a PIN or biometric re-authentication. These keys can then be used to generate valid WebAuthn assertions against Microsoft Entra ID.
—
### Key Takeaways
– None of these attacks break the underlying cryptographic protections of passkeys.
– The risks stem from implementation flaws, insecure storage, and weak session controls.
– Both synced and device-bound passkeys remain vulnerable to different attack paths, emphasizing the need for layered security.
—
### FAQ
**Q: Are passkeys still safer than passwords?**
Yes. Despite these findings, passkeys remain more secure than traditional passwords because they resist phishing and remove the risk of reused credentials.
**Q: What should I do to stay protected?**
Install Microsoft’s latest security updates immediately, especially patches addressing CVE-2026-34348. Enforce phishing-resistant MFA and follow Microsoft’s latest Entra migration guidance.
**Q: Can these attacks work remotely?**
No. All three attack vectors require either malware already running on the device or access to a compromised user session. They cannot be exploited from an unauthenticated position.
**Q: Is Google Password Manager unsafe?**
The issue lies in how Chrome temporarily exposes the Security Domain Secret in memory and logs. Google has removed the secret from logs, but recovery during re-registration remains a concern until better key rotation mechanisms are implemented.
**Q: What about Windows Hello for Business?**
It remains secure when properly configured, but the research shows that compromised endpoints or sessions can abuse legitimate cryptographic operations. Ensuring strong endpoint protection and updated patches is critical.
—
### Conclusion
While passkeys represent a major step forward in authentication security, these recent discoveries underline that implementation details and surrounding controls matter just as much as the cryptographic foundation. Organizations and users must adopt a holistic Zero Trust approach—combining updated systems, strong endpoint defenses, and phishing-resistant policies—to ensure passkeys deliver on their promise. As Microsoft continues to tighten authentication requirements, staying informed and proactive will be essential to maintaining resilient identity security.
