EmbeddingGemma 2: an open, lightweight multimodal embedding model
deepmind.google·6d ago
AI Engineering
Hacker News·Aug 4·5 min read
Pass the Passkey: A Novel Attack Surface in Passwordless Authentication
TL;DR
New attack vectors against passwordless authentication have been identified, particularly targeting Google’s passkey ecosystem. Malware can exploit device trust workflows to hijack accounts without user interaction.
✦ Why It Matters
Evaluate your current security measures against potential malware threats targeting passwordless systems.
Key Takeaways
- Implement stricter user verification for passkey authentication.
- Monitor for malware on devices to prevent account takeovers.
- Educate users on the risks of passwordless systems.
- Regularly update security protocols to address emerging vulnerabilities.
How It Works
The Pass-ta-key attack exploits the ability of malware to silently generate authentication signatures using the device's identity key, bypassing user interaction and verification. By mimicking legitimate authentication requests, attackers can gain access to accounts without needing elevated privileges.