#passkey
passkey
7,057 views
17 Discussing
Hot
Latest
The Hong Kong SFC has taken action, directly drawing red lines for virtual asset trading platforms and internet brokerages: logging in and device setup can no longer use one-time passwords (OTP). It must be replaced with authentication methods that can prevent spoofing and phishing, such as passkeys and device binding.
Large brokerages must implement this immediately; other institutions have up to 12 months to complete the remediation. At the same time, they must strengthen monitoring and alerting for suspicious logins, trading, and withdrawals, promptly notify customers, and respond to hacker intrusions.
Personal view: the OTP era really should be moved on from. SIM card hijacking, phishing sites acting as man-in-the-middle to relay verification codes—these old tricks drain assets every year in amounts that aren’t small. With passkeys binding private keys to the device’s secure chip, phishing websites can’t get the keys—they simply can’t. That’s the real root-and-branch fix.
The message to the industry is also very clear—compliance barriers are being raised, and security costs will be passed on to operators, putting more pressure on smaller platforms. But for users, this is a good thing: the probability of account theft will drop significantly.
Are you still using SMS verification codes to log into exchanges? I recommend switching to passkeys or hardware keys as soon as possible.
#香港加密监管 #账户安全 #Passkey
Large brokerages must implement this immediately; other institutions have up to 12 months to complete the remediation. At the same time, they must strengthen monitoring and alerting for suspicious logins, trading, and withdrawals, promptly notify customers, and respond to hacker intrusions.
Personal view: the OTP era really should be moved on from. SIM card hijacking, phishing sites acting as man-in-the-middle to relay verification codes—these old tricks drain assets every year in amounts that aren’t small. With passkeys binding private keys to the device’s secure chip, phishing websites can’t get the keys—they simply can’t. That’s the real root-and-branch fix.
The message to the industry is also very clear—compliance barriers are being raised, and security costs will be passed on to operators, putting more pressure on smaller platforms. But for users, this is a good thing: the probability of account theft will drop significantly.
Are you still using SMS verification codes to log into exchanges? I recommend switching to passkeys or hardware keys as soon as possible.
#香港加密监管 #账户安全 #Passkey
See translation
Log in to explore more content