谷歌密码钥匙三招被破！为何传统密码仍更安全？

Passkeys are still safer than passwords. That is the answer, and the research behind the scary headlines says so too. On 3 August 2026, Palo Alto Networks' Unit 42 published three techniques that let malware take over accounts protected by Google-synced passkeys. No fingerprint, no PIN, and no prompt on screen. The coverage that followed skipped the part readers need: exactly who is exposed, and what to change. The real scope is narrow. The fix is cheap. The standard itself is not broken.

A passkey is a key pair that replaces a password. The private half stays on your device or in a synced store, and the site only ever sees a signature. Unit 42 named three variants, not four. Several outlets reported a fourth, including 9to5Google. The research describes three (Unit 42, 3 August 2026).

Pass-ta-key. Malware extracts Chrome's device identity key and uses it to sign a request. No admin rights, no device unlock, no user action.

Silver Pass-ta-key. The attacker forces Chrome to re-register the device. They then register their own user-verification key with Google's cloud authenticator. Afterwards they can sign in from their own machine, and the cloud authenticator believes a fingerprint check happened.

Golden Pass-ta-key. The attacker pulls the Security Domain Secret out of Chrome's process memory during onboarding. The Security Domain Secret is a 32-byte master key that protects every synced passkey. With it, they all decrypt. This is the variant that turns one infection into a saleable bundle (BleepingComputer, 3 August 2026).

The target is not the passkey file on disk. It is the Google Cloud Authenticator behind Google Password Manager, and the trust it puts in a device that malware is now imitating (The Hacker News, August 2026).

Who is actually affected? This is the question the coverage left open. Against the research's own stated scope: all three attacks require the device to be already infected. Unit 42 explicitly says "not tested" is not "safe", but the tested scenarios all begin with malware present on the victim's machine. If malware can read your browser's memory, it can also steal passwords, cookies, and session tokens. The passkey-specific attack adds another exfiltration channel, but it does not lower the bar for an already compromised system.

The fix is straightforward. If you are a high-value target—journalist, activist, executive—stop syncing passkeys through Google Password Manager. Use a hardware security key (such as a YubiKey) as your primary authenticator. For everyone else, keep using passkeys, but keep Chrome updated, avoid admin accounts, and check your Google account's registered devices for anything unfamiliar.

The scary headlines said passkeys are broken. The research actually says the opposite: the standard is sound, the attack surface is narrow, and the remedy is available today. Passkeys are still safer than passwords—provided you choose the right deployment.