New Pass-ta-key attack reveals all the things we didn't know about passkeys

A researcher demonstrated "Pass-ta-key," a technique where malware on a Windows host can obtain all passkeys stored in Google Password Manager; the report clarifies that this is possible because FIDO2 does not mandate hardware (TPM) storage for passkeys and many platforms keep them in software, which exposes them to local compromise rather than indicating a novel flaw in passkeys themselves.