Pass-ta-key extracts GPM passkeys on Windows via local storage, not TPM

The attack works because passkeys on Windows GPM are stored in app-accessible local files rather than the TPM. FIDO2 specifications never required hardware enclaves for consumer sync; only Microsoft enforces TPM options for enterprises. Malware running with user privileges bypasses Windows sandboxing in one direction, reading data from sandboxed apps without OS compromise. macOS, iOS, and Android enforce bidirectional isolation that blocks the same vector absent a kernel zero-day.

Primary evidence comes from the FIDO Alliance CTAP2 and WebAuthn specifications, which define credential storage as platform-dependent with no hardware mandate. Microsoft documentation states TPM storage is optional and mainly recommended for domain-joined devices. Real-world incidents show no equivalent extraction on non-Windows platforms since the 2022 shift to sync-capable local storage.

Operationally this means Windows passkey users must treat the OS as the trust boundary. Enterprises should enforce TPM-backed credentials via policy while consumers on other platforms retain the original security assumptions. The attack adds no new surface beyond existing malware capabilities against any locally stored secret.