Hackers just breached this top login protection service. Here’s what to do

Remember not too terribly long ago when we recommended passkeys over usernames and passwords due to their more stringent security? Well, a new fatal flaw just emerged, and it has us rethinking our original take. Here’s what you need to know about the new passkeys vulnerability, plus what you can do to protect your data from attacks.

Well, this is awkward. We just got done saying how much better it is to use passkeys over usernames and passwords. Personally, every passkey available to me is enabled on my accounts, so maybe I’m a walking target. Perhaps you are, too, especially if your passwords are saved in Google’s software ecosystem.

Passkeys were meant to be a more perfect way to protect access to your online accounts.

This newly discovered malware — dubbed Pass-ta-key — specifically targets the passkeys system attached to Google Password Manager, the first-party password storage app built into Google Chrome and Android. The researchers who discovered the flaw hacked into Google Passkeys through the Chrome browser on a Windows PC using all three of these methods:

• The basic Pass-ta-key exploit ultimately tricks Google’s authentication system into accessing the passkey-protected website with no identity verification (PIN, biometric data, or password) necessary.
• Silver Pass-ta-key takes the exploit a step farther by erroneously convincing the system that the user did provide identity authentication to gain access to a website or service, treating it just like a user-confirmed event.
• As for Gold Pass-ta-key, this top-tier exploit steals the entire passkey vault from Chrome by targeting Google’s master key system at the time a device is registered or an account is recovered.

There’s no word on whether or not other operating systems (such as macOS or Linux) and Chromium-based browsers (like Microsoft Edge and Brave) are equally susceptible, but since Windows is the largest PC platform in the world and Chrome is the most popular browser on the market, this threat puts billions of computer users at risk worldwide.

RELATED: Tired of password insanity? Make this safer, stronger choice.

Rawf8/Getty Images

Not a Windows user? You still have a reason to worry.

Apple customers aren’t out of the woods, either. A separate Apple passkey exploit was recently discovered for iCloud+ subscribers who use iCloud Private Relay, a feature meant to hide your IP address from the sites you visit online. Thanks to a WebKit bug, websites that request passkey verification may also see your IP address, even when iCloud Private Relay is enabled. The only way to stop this is to use a browser without WebKit or rely on a third-party VPN service. On the bright side, at least your passkey vaults will stay concealed.

What to do to protect yourself

Passkeys were meant to be a more perfect way to protect access to your online accounts, which is critical in an age when AI makes it easier than ever to hack systems and steal data. Despite malware like Pass-ta-key, passkeys are still more secure than traditional usernames and passwords. However, if these exploits give you pause to trust such a solution, you’re not alone. The good news is that Pass-ta-key requires pre-existing malware to already be present on the target computer, and as long as you refrain from downloading apps and services from sketchy places online, your chances of contracting this malware are on the lower side.

For those who still aren’t convinced, you might be asking yourself what you can do next to protect your accounts. Unfortunately, there aren’t many viable options left.

The truth is that it’s hard to recommend a foolproof password manager these days, as most of them have endured some kind of breach, hack, or vulnerability at one point or another. At this point, you might be better off etching your credentials on a stone tablet than putting them into a digital device. And if you don’t have one of those handy, just keep an eye on Blaze News for updates on which password exploit pops up next. We’ll report on it when we hear about it.