Comment by koito17
7 days ago
> It's going to be the banks first.
In Japan, this is already the reality. The FSA required brokerages to implement passkey authentication, and the effect is that it's no longer possible to have a brokerage account without a passkey. (Some brokerages, like Nomura Securities, will offer two separate client portals. The portal with money and trading-related functionality requires a passkey).
The thing that sucks a lot is that brokerages seem to also restrict the allowed software/hardware. Don't know the details, but none of my FIDO2 hardware keys were able to be used. I consistently use these hardware keys through WebAuthn, so I was surprised when my brokerage explicitly told me my hardware key is unsupported and I must use either Windows Hello or the iOS Passwords app.
The FSA's official explanation for mandating passkey implementation is that people kept falling for phishing attacks, and the attacks were getting too sophisticated thanks to "AI" or something.
> The thing that sucks a lot is that brokerages seem to also restrict the allowed software/hardware. Don't know the details, but none of my FIDO2 hardware keys were able to be used. I consistently use these hardware keys through WebAuthn, so I was surprised when my brokerage explicitly told me my hardware key is unsupported and I must use either Windows Hello or the iOS Passwords app.
Of course not, you still have some control over those FIDO2 hardware keys and they don't lock you to a limited set of devices. That's what the attestation is for, to allow banning the use of sign-in with anything but a couple megacorp providers. The few small time hangers on will be expelled in time. They're useful idiots for the adoption phase.
Notice that after lots of complaining about there being no way to transfer keys in the spec they developed some planned working group that will in the end only allow transferring from Google/Microsoft/Apple and maybe a few other dumpster companies. They aren't going to give that control up.
> The FSA's official explanation for mandating passkey implementation is that people kept falling for phishing attacks, and the attacks were getting too sophisticated thanks to "AI" or something.
Ah, yet another case of people being forced to use technology instead of being left alone doing things the old way where they understood all the risks.