Your digital front door might be less secure than you think, even with those fancy new passkeys.
Security experts recently uncovered three new ways bad guys can sneak into your online accounts, even if you’re using passkeys, the new password-replacement technology. These attacks target devices already infected with malware, specifically Windows computers that sync their passkeys with Google Password Manager.
Here’s what happened: once malware is on your computer, it can trick Google Password Manager into giving up your passkeys. Think of it like this: if a thief already has a duplicate key to your house (the malware), they can then use that key to open your safe (Google Password Manager) and steal the new, super-secure keys to your car (your passkeys). This lets them bypass all the usual security checks and completely take over your accounts.
Why does this matter? Passkeys were designed to be a stronger, more convenient alternative to passwords. They’re meant to be resistant to phishing (those fake login pages) and easier to use. This new discovery shows that even with these advanced security measures, if a hacker can get malware onto your device, they can still find a way in. It's a reminder that no single security measure is a magic bullet.
While the source material doesn't compare this to other AI models or companies, it highlights a common theme in cybersecurity: the constant cat-and-mouse game between security developers and attackers. As new protections like passkeys emerge, resourceful attackers quickly look for new vulnerabilities. This specific vulnerability targets the way passkeys are stored and synchronized on compromised devices, rather than a flaw in the passkey technology itself.
What should you do? The most important step is to prevent malware from getting on your computer in the first place. Use strong antivirus software, be cautious about clicking on suspicious links or downloading attachments, and keep your operating system and all your software updated. These basic hygiene steps are often overlooked but remain your first line of defense against sophisticated attacks.
Even with advanced security like passkeys, protecting your device from malware is still your best defense against account takeovers.