Think passkeys protect you from hacking and malware? Think again

While most people may have heard of passkeys, many still don’t fully understand how they work. But according to new research, understanding what passkeys don’t protect you from may be just as important as understanding what they do.

Researchers from Palo Alto Networks’ Unit 42 (via Bleeping Computer) uncovered three ways malware on a compromised Windows PC could abuse Google Password Manager’s synced passkeys by exploiting weaknesses in device trust and recovery, rather than breaking passkey cryptography itself.

Notably, every attack requires malware to be running on the victim’s Windows PC. The research targets Google Password Manager’s synced passkeys in Chrome on Windows devices with a Trusted Platform Module (TPM). It’s not a remote exploit against Google accounts.

The first attack, Pass-ta-key, lets malware authenticate without triggering Windows Hello or biometric verification, but only on services that don’t strictly require user verification. The second, Silver Pass-ta-key, goes further by registering an attacker-controlled verification key, allowing the researchers to bypass that limitation. They demonstrated the technique against eBay before responsibly disclosing it, and eBay has since patched the issue.

The most concerning finding is Golden Pass-ta-key. Researchers showed they could recover the master secret protecting synced passkeys, allowing them to decrypt every passkey tied to an account.

Google has removed one of these oversights by eliminating the secret from Chrome’s debug logs, but Unit 42 says it remains recoverable from memory during device re-registration. The report also notes there’s currently no way to rotate or revoke that master secret if it’s compromised.

The takeaway from this report isn’t that passkeys are broken. Unit 42 says the cryptography held up throughout its research. Instead, the attacks expose gaps between the security guarantees users expect and how device trust, onboarding, and recovery work in practice.

Passkeys are still a major improvement over passwords. But this research simply reinforces an old lesson that if malware compromises a trusted device, no authentication system is immune.