Passkeys in a compromised account
In today's (2/26) Wall Street Journal is an article about someone whose 1Password account was hacked via Github malware with the hacker gaining access to the poor guy's vault(s). He did not have 2FA enabled for his 1Password account. (Not sure about the secret key in this scenario?) (Article titled: "A Disney Worker Downloaded An AI Tool. It Led To A Hack That Ruined His Life."
In his 1Password account were credentials that included 2FA one-time codes. There are some (me) who believe having a 2FA code in 1Password along with the username and password is a bad idea as if a compromise occurs, all the bits to get into an account are right there. So I use an authenticator app for critical accounts. Simple enough, second factor is someplace else, so bad guys need to do more work to get into an account.
But it got me thinking about passkeys. I've done forum searches and other digging on this question, and I'm still not quite sure on the answer. And that is, if, as in the above scenario, my 1Password account is compromised and a hacker gains access to my vaults with my credentials via a browser, do the passkeys stored in 1Password enable access to those accounts? Or is there something about the passkey security model that prevents access in this scenario?
At this point I'm thinking the answer is yes as the private key is stored in 1Password - that's why the passkey works on all my devices.
That said, the question remains. I look forward to reading the answer.
Hey JAC3467! đź‘‹
First, to address the core concern that some folks might have upon jumping into this thread: 1Password itself was not hacked. In this case, the attacker compromised the individual’s local device and intercepted their Account Password using a keylogger, which allowed them to log into 1Password. Once a device is compromised, an attacker can gain nearly unrestricted access.
While enabling 2FA on your 1Password account is a great security measure, it would not have prevented this specific attack. 2FA on your 1Password account helps protect against unauthorized access from new or untrusted devices—but since the attacker was logging in from the victim’s already-authorized device, 2FA wouldn’t have applied in this scenario.
To guard against attacks that exploit compromised devices, you should:
- Ensure device integrity — keep your devices free from malware by installing security updates, enabling built-in security features, and using endpoint protection tools that actively detect and prevent threats.
- Trust only verified sources — download software exclusively from trusted providers. Avoid unverified applications that could contain hidden malware.
- Strengthen authentication for critical accounts —use phishing-resistant authentication methods like hardware security keys (e.g., YubiKey) or a separate authenticator app to reduce the risk of credential compromise.
- Limit exposure from browser extensions — review and disable unnecessary or untrusted extensions, as they can introduce vulnerabilities that attackers may exploit.
