New research pokes a hole in Google's synced passkeys - here's what it does and doesn't mean

We've spent a fair bit of this blog telling you passkeys are the safer way to sign in - and they still are. But a piece of research out this week deserves an honest mention, because it pokes a hole in one specific setup. On August 3, Palo Alto Networks' Unit 42 team published three attacks - nicknamed Pass-ta-key, Silver Pass-ta-key and Golden Pass-ta-key - that let malware hijack the passkeys Google syncs across your devices.

Two things matter before anyone panics. First, this doesn't break passkeys themselves - the underlying cryptography is untouched, and passkeys still can't be phished the way a typed password can. What the researchers found are gaps in how Chrome and Google Password Manager sync and trust passkeys on Windows. Second, and just as important: every one of these attacks needs malware already running on your PC. Nothing here reaches across the internet to a clean machine. If a stealer is already on your computer, though, the worst case ("Golden Pass-ta-key") lets it pull a master key out of Chrome's memory and decrypt every passkey you've synced. Google was told before the findings went public, and some affected sites have already tightened things up.

So the takeaway isn't "stop using passkeys." It's the same lesson underneath almost every threat we cover: keep malware off the machine in the first place, because that's the domino everything else depends on. Don't run installers from search ads or random download pages, keep Windows and Chrome patched, and if you want the sturdiest option of all, a hardware security key or a device-bound passkey can't be synced to the cloud - so it isn't exposed to this at all.

Since these attacks only get going once something nasty is already installed, Tendvane's Safety check earns its keep here: it flags unexpected programs auto-starting from your AppData or Temp folders and browser extensions you don't recognise - exactly the leftovers an infostealer tends to drop.