Earlier quoted context omitted.
I thought the point of storing secrets in hardware TPM and not giving them out into userspace (i.e. passkeys instead of passwords) is protecting against malware as well. And they claim that for Chrome on Windows: > Unlike a legitimate user flow that requires user interaction and device unlock, this attack shows how malware can obtain the required signature silently, without user consent, biometrics, device unlock or…
The reason why the attack works without “biometrics or device unlock” is because it only works on passkeys that were issued without requiring user verification: > The Pass-ta-key attack is effective when the relying party does not strictly require user verification. Many relying parties configure WebAuthn’s userVerification parameter as preferred rather than required to support diverse devices and user experiences, m…
Do you happen to know if this is because Google had to implement sync in userspace, or is it an inherent limitation that could also affect Apple?