What the Pass-ta-key Attack Actually Shows About Passkeys
Pass-ta-key showed malware extracting passkeys from Google Password Manager on Windows, but the attack requires an already infected computer and is not unique to passkeys.
Pass-ta-key, a recently described attack involving passkeys on Windows, has prompted questions about how passkeys are stored and whether they remain a safe alternative to passwords. The demonstration showed that malware on a Windows computer could obtain passkeys stored in the Google Password Manager app.
That result surprised users who assumed passkeys were always confined to a device’s trusted platform module. However, the reported attack does not establish a new weakness unique to passkeys. Its significance depends heavily on one central condition: the Windows machine must already be infected with malware.
What the researcher demonstrated
Arie Olshtein, a researcher at Palo Alto Networks, described Pass-ta-key in a post about passwordless authentication risks. The name combines “passkey” with “pass the key,” while also making a reference to a plate of pasta.
According to the report, Pass-ta-key could obtain all passkeys stored in the Google Password Manager app for Windows when that app was running on a malware-infected computer.
The demonstrated scenario therefore involved several specific elements:
- A Windows computer
- The Google Password Manager app
- Passkeys stored by that app
- Malware already present on the machine
Those boundaries matter. The finding was not presented as a remote attack that could independently break into an otherwise uncompromised computer. It examined what malware could access after the underlying system had already been infected.
Why the report caused concern
Much of the reaction came from assumptions about the trusted platform module, or TPM. A TPM is a locked-down enclave in a hardened silicon chip that Windows systems can use to store cryptographic keys and other highly sensitive information.
Many people believed passkeys were stored exclusively inside the TPM. Under that assumption, malware should not be able to extract a complete collection of passkeys from an application. The ability of Pass-ta-key to obtain the passkeys held by Google Password Manager appeared to conflict with that understanding.
The resulting concern was not only about this particular demonstration. It also exposed uncertainty about what people mean when they say passkeys are “stored” on a computer and what protections apply to passkeys managed by an application.
The attack is not unique to passkeys
Although the researcher characterized the issue as a “novel attack surface,” the attacks outlined in the post are neither novel nor exclusive to passkeys, according to the source report.
That distinction is important when evaluating the broader security of passkey authentication. Pass-ta-key does not show that the passkey concept itself has been cryptographically defeated. Instead, it describes passkeys being obtained from a password manager application on a system where malware is already operating.
Treating the demonstration as proof that all passkeys are fundamentally unsafe would go beyond what was reported. The findings concern a defined application and operating environment under an existing compromise.
What users can—and cannot—conclude
The demonstration offers a useful clarification about expectations surrounding passkeys. Users should not automatically assume that every passkey is stored exclusively within TPM hardware simply because the computer has a TPM. The Pass-ta-key report shows that passkeys stored by an application may be exposed when malware has compromised the system running that application.
At the same time, the report does not overturn the stated role of passkeys as a more secure alternative to password-based authentication. Nor does the supplied research establish that attackers can obtain passkeys from an uncompromised Windows machine.
The most relevant conclusions are narrower:
- Malware on a computer can create serious risks for authentication data accessible through applications on that computer.
- Storage assumptions matter when assessing passkey security.
- A demonstration involving Google Password Manager for Windows should not automatically be generalized to every passkey implementation.
- Claims of novelty should be separated from the specific technical conditions required for an attack.
Context is essential when assessing Pass-ta-key
Pass-ta-key highlights a gap between popular expectations about passkeys and the way one Windows application handles them in the demonstrated scenario. It also reinforces the importance of examining an attack’s prerequisites before drawing conclusions about an entire authentication technology.
The key fact is that the computer was already infected with malware. Within that context, the demonstration raises legitimate questions about application-level passkey storage, but it does not reveal a new attack category unique to passkeys or show that passkeys as a whole are unsafe.
Originally reported by Ars.
Originally reported by Ars.