{"id":565713,"date":"2026-08-11T12:54:08","date_gmt":"2026-08-11T12:54:08","guid":{"rendered":"https:\/\/www.newsbeep.com\/nz\/565713\/"},"modified":"2026-08-11T12:54:08","modified_gmt":"2026-08-11T12:54:08","slug":"new-pass-ta-key-attack-reveals-all-the-things-we-didnt-know-about-passkeys","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/nz\/565713\/","title":{"rendered":"New Pass-ta-key attack reveals all the things we didn&#8217;t know about passkeys"},"content":{"rendered":"<p>Last week a researcher outlined what he said was a \u201cnovel attack surface\u201d in passkeys, the new authentication paradigm that offers a more secure alternative over password-based methods. In fact, the attacks demonstrated in the post are neither novel nor unique to passkeys. This distinction is important because the research has generated confusion among end users and security professionals as they assess whether this new mechanism is truly safe to use.<\/p>\n<p>The attack is called Pass-ta-key\u2014a blending of the word passkey with the phrase \u201cpass the key\u201d and a nod to a plate of pasta. Arie Olshtein, a researcher at security firm Palo Alto Networks, described in a <a href=\"https:\/\/unit42.paloaltonetworks.com\/passwordless-authentication-security-risks\/\" rel=\"nofollow noopener\" target=\"_blank\">post<\/a> last week how Pass-ta-key could obtain all passkeys stored in the Google Password Manager app (GPM) for Windows when it\u2019s running on a machine infected with malware.<\/p>\n<p>This came as a surprise to many people because they believed passkeys are stored exclusively in the trusted platform manager (TPM), the locked-down enclave in a hardened silicon chip that\u2019s reserved for storing cryptographic keys and other highly sensitive information on Windows machines. If passkeys are stored in the TPM, then how was Pass-ta-key able to extract the entire set of passkeys stored by the app, they wanted to know?<\/p>\n<p>Local passkey storage is OK, with one exception<\/p>\n<p>The answer is that, contrary to common belief, the <a href=\"https:\/\/fidoalliance.org\/specifications\/\" rel=\"nofollow noopener\" target=\"_blank\">FIDO 2 specifications<\/a>\u2014managed by the industry group FIDO Alliance\u2014don\u2019t mandate that passkeys be kept in TPMs, or any other sort of dedicated piece of hardware (they go by different names, depending on the platform, including secure enclaves, trusted execution environments, and StrongBoxes). In fact, most platforms and third-party software for managing passkeys do not store passkeys in such dedicated hardware. Virtually the lone holdout is Microsoft, which gives users the option to store passkeys in the Windows TPM. The company mainly recommends this choice to enterprises, not consumers.<\/p>\n","protected":false},"excerpt":{"rendered":"Last week a researcher outlined what he said was a \u201cnovel attack surface\u201d in passkeys, the new authentication&hellip;\n","protected":false},"author":2,"featured_media":565714,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[111,139,69,145],"class_list":["post-565713","post","type-post","status-publish","format-standard","has-post-thumbnail","category-technology","tag-new-zealand","tag-newzealand","tag-nz","tag-technology"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts\/565713","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/comments?post=565713"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts\/565713\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/media\/565714"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/media?parent=565713"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/categories?post=565713"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/tags?post=565713"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}