DBSC
Deepwater Beachfront Small Cap ETF
stock NASDAQ

Good comment. I totally agree on passkey support. However, if I had to nitpick, I might prioritize mitigating against infostealers above the quantum threat you mention.

As I understand it, infostealer malware harvests live session cookies/tokens directly from an infected device after a user has already authenticated--thereby bypassing MFA and passkeys entirely, since the attacker isn't stealing the credential, but the already-authenticated session.

Apparently, Chrome on Windows now has Device Bound Session Credentials (DBSC), which cryptographically binds a session to hardware on the user's device so a stolen session token can't be replayed elsewhere, are just beginning to address this threat. I'd ask that Fidelity's security roadmap address this threat as well --not just passkey adoption at login, but protections against post-authentication session theft, such as short-lived sessions, or requiring the user to re-authenticate for any substantive actions, or device-bound session credentials, etc. To some extent, I guess we can self-mitigate against this by only using Fidelity from mobile environments that tend to be more secure against malware (like iOS, etc).
It definitely is a hard problem.

Good comment. I totally agree on passkey support. However, if I had to nitpick, I might prioritize mitigating against infostealers above the quantum threat you mention.

As I understand it, infostealer malware harvests live session cookies/tokens directly from an infected device after a user has already authenticated--thereby bypassing MFA and passkeys entirely, since the attacker isn't stealing the credential, but the already-authenticated session.

Apparently, Chrome on Windows now has Device Bound Session Credentials (DBSC), which cryptographically binds a session to hardware on the user's device so a stolen session token can't be replayed elsewhere, are just beginning to address this threat. I'd ask that Fidelity's security roadmap address this threat as well --not just passkey adoption at login, but protections against post-authentication session theft, such as short-lived sessions, or requiring the user to re-authenticate for any substantive actions, or device-bound session credentials, etc. To some extent, I guess we can self-mitigate against this by only using Fidelity from mobile environments that tend to be more secure against malware (like iOS, etc).
It definitely is a hard problem.