Passkey Security Scare Highlights Common Misunderstanding About How They're Actually Stored

A security researcher last week demonstrated an attack method that could extract passkeys from Google Password Manager on Windows systems compromised by malware—setting off alarm bells among users and professionals who believed the credentials were locked away in hardware-protected vaults.

The reality is more nuanced. The Pass-ta-key demonstration, documented by Arie Olshtein at Palo Alto Networks, showcased neither a new vulnerability class nor something unique to passkeys themselves. Rather, it exposed a fundamental gap between how people think passkeys work and what industry standards actually require.

The Storage Misconception#

Passkeys have been widely marketed as a fundamentally more secure replacement for passwords, in part because many believed they were invariably stored in dedicated hardware—the trusted platform manager (TPM) on Windows machines, or equivalent secured enclaves on other devices. This assumption made the recent demonstration confusing: if these credentials lived in such hardened silicon, how could malware access them?

The FIDO 2 specifications, which define how passkey systems work, don't actually mandate hardware-backed storage. Instead, platform vendors and software makers have considerable flexibility in where they keep these credentials. Most implementations—whether through third-party apps or platform-level systems—don't use dedicated hardware at all. Microsoft remains a notable exception, offering (and primarily recommending to enterprises, not consumers) the option to store passkeys in the Windows TPM.

Why This Matters#

The confusion reflects a broader communication challenge: the security industry promoted passkeys as inherently superior without consistently explaining the conditions under which that superiority exists. A passkey stored in accessible software is vulnerable to the same threats that compromise any credential on a malware-infected device—a straightforward but important distinction that didn't get adequate airtime during the technology's rollout.