The promise of passkeys was a higher level of security than passwords, stemming from the fact that you can't give away a passkey. You cannot share it, and a malicious actor cannot phish a passkey like they can a password. But a recent post by Arie Olshtein, who works for cybersecurity company Palo Alto Networks, detailed a set attacks collectively nicknamed Pass-ta-key that can, in the worst case, extract all locally synced passkeys and then use them to log in to websites and do all kinds of bad things. The catch is that Pass-ta-key is possible to pull off only on Windows, and by the looks of it, only if the passkeys are managed by Google Password Manager in Chrome for Windows.
The main reason why Pass-ta-key is possible in the first place is because the specifications governing passkeys, which are managed by the FIDO Alliance, with its members including Apple, Google, Amazon, Meta, and many other major players in the tech space, do not require passkeys to be kept in dedicated hardware. On Windows, this is the TPM (Trusted Platform Module); on iOS devices and Macs, this is the Secure Enclave, and so on.
Instead, FIDO2 specifications allow passkey managers and similar solutions to store them locally on a device, in regular storage. The result is that many password managers that support passkeys do not store them in dedicated hardware in order to allow syncing between different devices, since having your passkeys locked to one device was a major reason for passkeys' slow adoption by users.
The logic behind this is that many operating systems implement granular, per-app permissions, making it virtually impossible for malware to get access to locally stored passkeys, as explained by Ars Technica's Dan Goodin. On Windows, however, apps generally run with the privileges of the user who launched them, making it relatively easy for malware to access the data of another app because Windows doesn't sandbox application data in the same way. This led some Windows passkey managers to store synced passkeys in encrypted cloud-backed storage and retrieve them when needed, rather than keeping the private keys exclusively on the local device.
Anyway, Google Password Manager for Windows, which was the target of the attacks, also syncs passkeys through the cloud while keeping encrypted copies of the synced passkey data locally. But unlike some other Windows passkey managers, Google's solution doesn't use some of the OS-level defense mechanisms used by other Windows passkey utilities, making it vulnerable to Pass-ta-key attacks, which exploit these weaknesses to take over passkey-protected accounts and, in the worst case, as demonstrated by the Golden Pass-ta-key attack, extract all synced passkeys stored in Google Password Manager. The attackers can do what they want with the extracted passkeys, including selling them on the credential black market.
While this sounds concerning on the surface, the reality is that passkeys are more or less as safe as ever. Pass-ta-key attacks can only work on Windows, and only if the device in question has already been compromised by malware. The attacks also specifically exploit Google Password Manager because the platform doesn't use some of the Windows defense mechanisms available to it, which other Windows passkey utilities use, making it vulnerable to malware, which can not only take over passkey-protected accounts but also extract passkeys.
In general, you don't have many reasons to be concerned. Firstly, Pass-ta-key is a demonstration created and shared in full by a security researcher, not a new type of attack discovered in the wild. This allows Google to potentially improve its Password Manager for Windows and make it more in line with other Windows passkey solutions. It also allows developers of other solutions to make their Windows versions even more secure and even more resilient against malware that could use techniques similar to those shared by Arie Olshtein.
Next, if you're using Google Password Manager on your Windows machine for passkey management, you can simply opt for another solution. While you can start using a password manager that supports passkey syncing, you can also use one that stores passkeys in dedicated hardware, such as Windows Hello, which can store passkeys in the TPM, or a YubiKey, neither of which is vulnerable to the Pass-ta-key attacks demonstrated by Arie and Unit 42.
While many passkey management solutions now support syncing between different devices, removing one of the biggest downsides of passkeys—the fact that they are locked to a single device—passkeys are still not ready to replace passwords entirely. They still have issues working between different platforms, can involve more work than simply autofilling a password field with your favorite password manager, and restoring them still often involves traditional methods such as email, SMS, or backup codes.
At the end of the day, you don't have to use passkeys in the first place. A password manager combined with a TOTP (time-based one-time password) app does the trick for most people. It's fairly secure, convenient, works great across platforms, and if you lose access to your TOTP app, you'll still be able to log in to websites where you use TOTP, as long as you have a backup recovery method available. For instance, I lost access to my TOTP app when my previous phone broke, but I managed to regain access to every single site I use TOTP for.
