#passkey
passkey
7,057 views
17 Discussing
Hot
Latest
The Hong Kong SFC has taken action, directly drawing red lines for virtual asset trading platforms and internet brokerages: logging in and device setup can no longer use one-time passwords (OTP). It must be replaced with authentication methods that can prevent spoofing and phishing, such as passkeys and device binding.
Large brokerages must implement this immediately; other institutions have up to 12 months to complete the remediation. At the same time, they must strengthen monitoring and alerting for suspicious logins, trading, and withdrawals, promptly notify customers, and respond to hacker intrusions.
Personal view: the OTP era really should be moved on from. SIM card hijacking, phishing sites acting as man-in-the-middle to relay verification codes—these old tricks drain assets every year in amounts that aren’t small. With passkeys binding private keys to the device’s secure chip, phishing websites can’t get the keys—they simply can’t. That’s the real root-and-branch fix.
The message to the industry is also very clear—compliance barriers are being raised, and security costs will be passed on to operators, putting more pressure on smaller platforms. But for users, this is a good thing: the probability of account theft will drop significantly.
Are you still using SMS verification codes to log into exchanges? I recommend switching to passkeys or hardware keys as soon as possible.
#香港加密监管 #账户安全 #Passkey
Large brokerages must implement this immediately; other institutions have up to 12 months to complete the remediation. At the same time, they must strengthen monitoring and alerting for suspicious logins, trading, and withdrawals, promptly notify customers, and respond to hacker intrusions.
Personal view: the OTP era really should be moved on from. SIM card hijacking, phishing sites acting as man-in-the-middle to relay verification codes—these old tricks drain assets every year in amounts that aren’t small. With passkeys binding private keys to the device’s secure chip, phishing websites can’t get the keys—they simply can’t. That’s the real root-and-branch fix.
The message to the industry is also very clear—compliance barriers are being raised, and security costs will be passed on to operators, putting more pressure on smaller platforms. But for users, this is a good thing: the probability of account theft will drop significantly.
Are you still using SMS verification codes to log into exchanges? I recommend switching to passkeys or hardware keys as soon as possible.
#香港加密监管 #账户安全 #Passkey
The Hong Kong Securities and Futures Commission has acted: It requires all virtual asset trading platforms and online brokerage firms to stop using one-time passwords (OTP) for customer logins and device binding, and instead use more phishing-resistant authentication methods such as passkeys (Passkey) or device binding.
Large brokerages must implement this immediately; other institutions have a maximum transition period of 12 months.
In addition, platforms must strengthen real-time detection of abnormal logins, trading, and withdrawals, promptly notify users of suspicious activity, and regularly warn customers about emerging phishing tactics.
The regulator’s message is clear— the OTP era has officially come to an end. For retail investors, this means the minimum standard for account security is being raised, but it also serves as a reminder: if you should be using hardware security keys and Passkeys, get them set up—don’t wait until you’ve been phished to regret it.
The stricter compliance is, the more it benefits the long run for reputable players that remain licensed.
#香港加密监管 #账户安全 #Passkey
Large brokerages must implement this immediately; other institutions have a maximum transition period of 12 months.
In addition, platforms must strengthen real-time detection of abnormal logins, trading, and withdrawals, promptly notify users of suspicious activity, and regularly warn customers about emerging phishing tactics.
The regulator’s message is clear— the OTP era has officially come to an end. For retail investors, this means the minimum standard for account security is being raised, but it also serves as a reminder: if you should be using hardware security keys and Passkeys, get them set up—don’t wait until you’ve been phished to regret it.
The stricter compliance is, the more it benefits the long run for reputable players that remain licensed.
#香港加密监管 #账户安全 #Passkey
Log in to explore more content