Convincing someone to log in to their bank and send you money is strictly harder than convincing someone to log in to their bank.

▲

throwawayffffas 5 hours ago | parent [-]

There is a middle ground where people are convinced to download a trojan and click ok once.

▲

somerandom2407 3 hours ago | parent | next [-]

And if the bank implements the best form of Passkey (and implements it well) in this case it would require the user to biometrically authenticate before sending money (perhaps based on dollar amount or transaction volume) to a new account. The user would hopefully learn over time that the biometric requirement is aligned with money transfers and would grow suspicious if they were prompted for it during a scam session.

▲

grebc 2 hours ago | parent [-]

You’re making life miserable with such ideas.

I bought a house earlier this year and the bank froze my deposit I sent to the real estate agent.

I rang the bank straight away and badgered them to unlock it ASAP in case the sale fell through for their BS fraud department to sift it.

They blamed the fact the real estate they’d never transacted with before, I politely told them they’re based in one state while I was purchasing in another.

It took 2 hours of back and forth to get them to send it, even after they did all their security questions.

It’s all a fugazi, they/governments do not want you having large amounts of money - it’s as simple as that.

▲

somerandom2407 an hour ago | parent [-]

Actually it's kind of the opposite. Right now the banks know how easy it is for someone to end up getting scammed, so they try to be really strict on picking up on potentially fraudulent transactions precisely because they can't trust endpoint security.

If they have something like this in place, they will have greater confidence in the transaction being genuine and less likely to block it. In this case, for such a large amount of money, relative to the size of your account, they might still be very cautious about it, but it would be less likely to cause an issue.

	▲	grebc 32 minutes ago \| parent [-]
		Yes, that’s what they’ve told you. Good that you listen to them.

▲

danpalmer 4 hours ago | parent | prev [-]

I'm not sure I follow this point? A trojan would fail to exfiltrate passkeys (assuming they're stored securely). It would be able to see a valid login and potentially use that session or exfiltrate the session, but wouldn't be able to get persistent account access. This seems better than stealing a password and getting persistent account access, or possibly stealing a TOTP code for the same. It's bad, but I think it's made better by passkeys? Unless I'm misunderstanding your point.

	▲	throwawayffffas 4 hours ago \| parent \| next [-]
		A trojan would succeed in using your session and potentially start sessions from your device in cases where your key does not require your confirmation or where they have found a bug to bypass that (it maybe as simple as providing simulated input events to the system). My point is the gains are overstated the main weakness is almost always user action. Passkeys will not magically solve all our security problems.
	▲	zten 4 hours ago \| parent \| prev [-]
		I think they're just counting on coaching the person through whatever privilege escalation is required when the trojan wants access to the passkey.