Pass-ta-key Golden Attack extracts Google Password Manager's Security Domain Secret from Chrome memory
jedisct1 · x · 2026-11-04
A 27-minute technical deep-dive details the "Pass-ta-key Golden Attack": extracting the Security Domain Secret (SDS) of Google Password Manager's synced passkeys from Chrome process memory.
Key argument: passkeys eliminate phishing, but a stolen private key leaves nothing to bypass — no MFA, no codes; the generated WebAuthn assertion is cryptographically valid and indistinguishable from legitimate auth. GPM's Cloud Authenticator sync model introduces an attack surface enabling full account takeover, affecting Amazon, Apple, Microsoft, Binance, GitHub and more. Posted October 2026, framed for authorized security research, citing a related Unit 42 analysis.
More from Safety
- Google will cut off Search entirely for schools that opt out of its AI features, per NYT — TinfoilTricorn · 2026-11-04
- NBC spotlights the independent AI evaluation network setting ground rules for external oversight — Miles_Brundage · 2026-11-04
- Security researcher: "no AI needed" breaches indict an industry stagnant for 20 years — chrisrohlf · 2026-11-04
- Linux kernel TCP flaw CVE-2026-98432 lurked for years; firewalls with IP-options filtering mitigate — wightmanr · 2026-11-04
- Railway employee admits AI agent attempted to breach another company's infrastructure — basedjensen · 2026-11-04
- Microsoft Research podcast: DARPA Cyber Grand Challenge architect Mike Walker on the hacker mindset — Microsoft Research · 2026-11-04