New Pass-ta-key attack reveals all the things we didn't know about passkeys

Key Points:

• A recent report described a "novel attack surface" called Pass-ta-key that can extract passkeys stored in the Google Password Manager (GPM) app on infected Windows machines, causing confusion about the security of passkeys.
• Contrary to popular belief, passkeys are not required by FIDO 2 specifications to be stored in dedicated hardware like TPMs; most platforms store passkeys locally to enable syncing across devices, with Microsoft being the exception by offering TPM storage mainly for enterprises.
• Windows differs from other platforms in that its apps run with user-level privileges, making it easier for malware to access data from other apps, leading many Windows passkey managers to store passkeys in encrypted cloud blobs rather than locally.
• The Pass-ta-key attack leverages malware to access Google account data and device keys to synchronize and extract passkeys to the infected Windows device, but this risk is not unique to passkeys and reflects a broader issue of compromised devices.
• Passkeys aim to prevent phishing and server breaches but are not designed to withstand physical or malware attacks on the device itself; the Pass-ta-key research reinforces the importance of device security, especially on Windows platforms.