Hacker News Reader

After looking at various keys and their features I chose basic FIDO2 with NFC with no storage or other fancy feature.

Keys with lots of feature have a larger code base and this means more bugs in the long term.

I use my FIDO2 keys for proxmox, ssh ed25519-sk, vaultwarden, nextcloud, GAFAM accounts.

Unfortunately I know of no bank that has adopted FIDO2/webauthn.

Note: Paypal only allows one FIDO2 key AFAIK, so not an option there.

Looking at bank security is probably the saddest landscape around. Most will ask you for a PIN at maximum and then tell you it's not possible to have stronger authentication because of "safety".

I wish there was stronger laws forcing banks to adopt stuff like that.

I wish there were laws making it the bank's problem if your account gets hacked. The security they choose to use is secondary, but you bet they'd be the most secure websites around if they were liable for the losses.

You won't probably get what you wish for: this is how it works in South Korea but the solution that the banks went is worse than SMS-OTP, where your bank is expected to monitor your computer (https://palant.info/2023/01/02/south-koreas-online-security-...).

Reply on news.ycombinator.com