Topic starter
11/08/2026 3:12 pm
TL;DR: Unit 42's Pass-ta-key research shows malware on a Windows device can extract synced passkeys from Google Password Manager, re-register a fraudulent key, or in the worst case decrypt every passkey tied to one account, according to RSA Security. Device-bound passkeys and stronger endpoint controls matter because synced credential stores create a shared trust anchor that enterprises cannot treat like consumer convenience.
Editorial analysis by NHI Mgmt Group, based on content published by RSA Security: “What the Pass-ta-key Attacks Reveal About the Risks of Synced Passkeys”.
Key questions
Q: What breaks when synced passkeys are used as a workforce default?
A: The trust boundary breaks.
Q: Why do synced passkeys increase account takeover risk after device compromise?
A: Because the attacker no longer needs to steal a reusable password.
Q: What do security teams get wrong about passwordless authentication in regulated environments?
A: They often treat passwordless as a convenience layer instead of a governance control.
Practitioner guidance
- Prioritise device-bound passkeys for workforce access Use device-bound or hardware-rooted passkeys for employees, administrators, and regulated workflows where a shared cloud secret would materially expand blast radius.
- Harden re-registration and recovery flows Require strong trusted-hardware verification before a new passkey can replace an existing one, and treat recovery as a privileged lifecycle event.
- Add endpoint detection to passwordless programmes Pair phishing-resistant authentication with malware detection on the same device class that stores or uses passkeys, so a compromised endpoint is flagged before reuse.
Bottom line: Synced passkeys can still be abused after endpoint compromise, so phishing resistance alone is not enough for enterprise assurance.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/08/2026 3:26 pm
Synced passkeys create a shared trust anchor that enterprise IAM cannot safely treat as device-bound assurance. The article shows that one cloud secret can govern multiple devices, which means compromise is no longer limited to a single endpoint. That is a structural mismatch for workforce access, where assurance should be tied to a controlled device or token, not a portable recovery model. The practitioner conclusion is straightforward: a synced credential estate behaves like a shared secret problem, not a simple passwordless upgrade.
A few things that frame the scale:
- eBay's passkey data shows 55-60% of passkey adoption happens on mobile, against around 20% on desktop.
A question worth separating out:
Q: Should organisations use synced or device-bound passkeys for privileged access?
A: For privileged access, device-bound passkeys are the better default because they keep the private key on a single device and narrow the portability of the credential. Synced passkeys are more convenient, but that convenience comes with different recovery and propagation assumptions. Privileged roles need the tighter assurance boundary.
👉 Read our full editorial: Synced passkeys expose a device trust gap in enterprise IAM