Google Cloud Authenticator: The Hidden Mechanisms of Passwordless Authentication
Summary: Unit 42 researchers examined how Google's synced passkeys work for Chrome desktop users, focusing on a cloud-based component they call the Google Cloud Authenticator that handles sensitive cryptographic operations. The analysis describes Chrome connecting to enclave.ua5v[.]com during passkey use, onboarding devices with two TPM-backed key pairs, and establishing a Noise_NK_P256_AESGCM_SHA256 encrypted WebSocket session authorized by a Google OAuth2 token with the secureidentity.action scope.
What you should know: Passkey private keys are decrypted and signatures are produced by a remote cloud service reached over a WebSocket, so the security of every synced passkey login depends on that cloud component and the OAuth2 token that authorizes it - an attack surface the researchers say has been largely unexplored and not publicly discussed.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Cloud Security
- Related
- Google Cloud Warns Three AMD Turin CPU Flaws Could Leak Data Across Processes in VMs Cyber Risks · Nov 12, 2026New Falcon Cloud Security Innovations Secure the Cloud AI Runs On Cyber Risks · Nov 04, 2026