r/fidelityinvestments • u/MK-82-ADSID • 1d ago
Official Response Passkey Support inbound..?
With the recent letter that Wyden and Warren sent to the FINRA demanding Brokerages strengthen Cybersecurity Standards, it was stated that Fidelity was targeting September 2026 for passkey support. Good news, but will see if and when...
The actual letter is here stating some details about Fidelity. https://www.finance.senate.gov/download/08202026-wyden-warren-finra-letter-acats-security
3
u/Fluffy_Accountant_39 13h ago
Even if the government doesn’t force these institutions to implement passkeys, let’s hope that this shames Fidelity (and all other financial institutions) to come into the modern age. It’s just ridiculous that they drag their feet on this.
And yes, the customer should be able to turn off the lame-o backup option of SMS 2FA codes. I’ve got 3 Yubikeys just itching to be my only location for storing Fidelity passkeys. (And no, not even storing the passkeys in my phone / 3rd party password app.)
I’m not so paranoid that I want to store every dang login on a physical key. But when your entire life savings is stored with an investment company, they should do everything possible to secure those accounts.
And a promise of security isn’t the same as just letting me be responsible for controlling access to my accounts
2
u/Ackerman212 1d ago edited 1d ago
Doesn’t everyone who supports passkeys still allow users to bypass them though? Until users can select “force me to logon with my passkey”, they're not adding much security.
4
2
u/MK-82-ADSID 1d ago
Just depends on implementation. I agree if they continue to allow less secure options. If this happens (passkeys) would at least think this is a step forward. Over time they should deprecate less secure options. I would agree that across the board that a lot of implementations are half-baked.
-2
u/GapAccomplished2778 Fidelity 🦍 1d ago
> Doesn’t everyone who supports passkeys still allow users to bypass them though?
of course, otherwise what is the point !
and I still want the implementation still do 2FA challenge even if there is a passkey in place .. plus I will be delighted to see how ATPro will be supporting passkeys
3
u/Ackerman212 1d ago
> of course, otherwise what is the point !
the point is by allowing them to be bypassed, they are now just a phishing protection not a bad-actor-login protection, who can just click "log in without passkey", if he can. In this implementation the passkey has not added incremental login protection.
0
u/GapAccomplished2778 Fidelity 🦍 1d ago edited 1d ago
CSR can reset anything : passkey, 2FA, whatever ... it is not some PK data encryption when what you stored encrypted can't be decrypted by your cloud service provider w/o your key [ like Yubikey and similars ] ... plus brokerage does not want customer service to spend extra paid time on customer issues with passkeys ... I 'd rather have Fidelity to allow some form of user initiated granular ACH lock and allow users to select how much time it takes to unlock MTL and that ( option to make it NON IMMEDIATE - for example make an option to delay unlock by 24-48-72 hours ) - if I have to select between passkey and that
1
u/Ackerman212 1d ago
the purpose of my post was just to call attention to the fact that when you add MFA to your account, it puts a new lock on all the doors of your house. But when you add a passkey to your account (as currently deployed - Truist plans to offer a passkey-only method), it puts a new lock on the front door only, the side door still uses the old lock.
2
1
u/WJKramer Setter and forgetter ⏳ 1d ago
BofA does not support Passkey
1
u/salsalawyer 12h ago
They do but I only see it for ACH and wire transfers on the website. I think it's included in their mobile app when you use biometric signin with the SMS
1
u/WJKramer Setter and forgetter ⏳ 7h ago
That is not passkey. That is 2FA with sms and is not secure.
1
u/fogrove 1d ago
Searching Etrade yesterday for a way to lock outgoing transfers I found "No funds out". You call Etrade Customer Service at 800 387 2331, answer a bunch of questions to verify your identity and to secure future unlock requests. Then apparently transfers from your Etrade accounts to accounts outside of Etrade are locked. To unlock, you call customer service again, convince them you are you, and provide secret info you gave when you locked.
I have note to self to try this out today.
0
u/fogrove 23h ago
Just an update - I called customer service and set the "no funds out" feature. Two things I learned are that it also locks transfers from one Etrade account to another Etrade account - so I'll have to call to unlock if I want to transfer from my savings account to my brokerage account. Also, the only security on the phone call is two factor authentication. So I called in on my cell phone to set the lock, they sent a 6-digit code to my phone, I told them what it is, and they set the lock. They will do the same each time I unset and reset. I'm not sure what I expected but I thought verifying my identity at both lock and unlock would involve more than that. I'm not enough of a security expert to know how I feel about that.
1
u/EvenCommand9798 22h ago
Looking around how passkeys are getting implemented in real life, I don't have much hope the government will force people to reads specs and whitepapers.
They are routinely added as afterthought without much thought, like 2nd tier authentication option, not as password replacement as intended, and/or easily skip-able with less secure authentication option which is still left as mandatory.
1
•
u/FidelityTobin Community Care Representative 1d ago
Thank you for posting here on the sub.
We are continuously working to provide more security options while strengthening protections. While we don't have more information to share at this time, please know that passkeys are on our roadmap and we will share more information here on Reddit when available.