As passkey adoption accelerates following the Financial Services Agency's guideline revision, the possibility of unauthorised transactions using passkeys on a securities trading website has been reported. This article explains how synced passkeys work, where private keys are managed, the risk of losses and the countermeasures available.
Following last year's unauthorised access incident, the Financial Services Agency revised its comprehensive supervisory guidelines and made phishing-resistant authentication methods mandatory as a form of multi-factor authentication. Against this backdrop, businesses, including securities trading services, are adopting passkeys in place of conventional passwords in an effort to achieve both convenience and security.
Passkeys authenticate users on a device using a public key and a private key. The device signs a challenge with the private key, and the service verifies the signature using the public key. Synced passkeys are managed in both the cloud and on the device, while device-bound passkeys are managed only on the device. Most implementations use synced passkeys, which offer greater convenience when using multiple devices or changing devices.
In the latest incident, suspected unauthorised transactions were reported even in securities trading accounts with passkey authentication enabled, and it was reported that account takeover on the platform operator's side may have been involved. Attackers are increasingly targeting the theft of platform IDs, making phishing protection and monitoring for unauthorised device logins important.
Recommended measures include strengthening platform account monitoring and protection against phishing emails, as well as regularly checking the devices currently logged in. For organisations, the article also introduces a method of adding client certificates and managing private keys strictly within devices.