Signing back into the Community for the first time? You'll need to reset your password to access your account.  Find out more.

Forum Discussion

JAC3467's avatar
JAC3467
Occasional Contributor
4 hours ago

Passkeys in a compromised account

In today's (2/26) Wall Street Journal is an article about someone whose 1Password account was hacked via Github malware with the hacker gaining access to the poor guy's vault(s).  He did not have 2FA enabled for his 1Password account.  (Not sure about the secret key in this scenario?)  (Article titled: "A Disney Worker Downloaded An AI Tool.  It Led To A Hack That Ruined His Life."

In his 1Password account were credentials that included  2FA one-time codes.  There are some (me) who believe having a 2FA code in 1Password along with the username and password is a bad idea as if a compromise occurs, all the bits to get into an account are right there.  So I use an authenticator app for critical accounts.  Simple enough, second factor is someplace else, so bad guys need to do more work to get into an account.

But it got me thinking about passkeys.  I've done forum searches and other digging on this question, and I'm still not quite sure on the answer.  And that is, if, as in the above scenario, my 1Password account is compromised and a hacker gains access to my vaults with my credentials via a browser, do the passkeys stored in 1Password enable access to those accounts?  Or is there something about the passkey security model that prevents access in this scenario?

At this point I'm thinking the answer is yes as the private key is stored in 1Password - that's why the passkey works on all my devices. 

That said, the question remains.  I look forward to reading the answer.

 

 

 

 

No RepliesBe the first to reply