Google Authenticator: The Hidden Mechanisms of Passwordless Authentication

This report reveals how Google’s cloud-based passkey authenticator fundamentally reshapes passwordless authentication by blending hardware-backed device keys with cloud-managed key operations—unlocking seamless cross-device login while introducing a new, largely unexplored attack surface for adversaries.