[{"content":"A Significant Change in Authentication On 9 July 2026, the Hong Kong Securities and Futures Commission (SFC) issued a new circular requiring internet brokers and SFC-licensed virtual asset service providers (VASPs) to adopt robust, phishing-resistant authentication methods to protect clients\u0026rsquo; trading accounts.\nOne part of the circular immediately caught my attention:\nThe SFC does not consider OTP to be a phishing-resistant authentication solution.\nThe SFC specifically says that internet brokers and VASPs should not use email OTPs or SMS OTPs for client login and device-binding processes.\nInstead, the circular identifies passkeys and bound devices as examples of robust authentication solutions.\nThis is an important signal for the identity and authentication industry.\nThe question is no longer simply:\n\u0026ldquo;Do we have MFA?\u0026rdquo;\nIt is becoming:\n\u0026ldquo;Is our authentication actually resistant to phishing?\u0026rdquo;\nWhy Is the SFC Making This Change? The reason is straightforward: phishing attacks are still extremely effective.\nAccording to the SFC, phishing accounted for 57% of the security incidents reported to the Hong Kong Computer Emergency Response Team Coordination Centre in 2025.\nThe SFC also described large-scale SMS phishing campaigns targeting clients of internet brokers and VASPs.\nThe attack pattern is familiar:\nFake SMS ↓ Fake broker website ↓ User enters username/password ↓ User enters OTP ↓ Attacker captures the credentials ↓ Attacker gains access to the account ↓ Unauthorised transactions ","permalink":"https://liuguiyu.github.io/posts/hong-kong-sfc-passkey/","summary":"\u003ch2 id=\"a-significant-change-in-authentication\"\u003eA Significant Change in Authentication\u003c/h2\u003e\n\u003cp\u003eOn 9 July 2026, the Hong Kong Securities and Futures Commission (SFC) issued a new circular requiring internet brokers and SFC-licensed virtual asset service providers (VASPs) to adopt robust, phishing-resistant authentication methods to protect clients\u0026rsquo; trading accounts.\u003c/p\u003e\n\u003cp\u003eOne part of the circular immediately caught my attention:\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003eThe SFC does not consider OTP to be a phishing-resistant authentication solution.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003cp\u003eThe SFC specifically says that internet brokers and VASPs should not use email OTPs or SMS OTPs for client login and device-binding processes.\u003c/p\u003e","title":"Hong Kong SFC Moves Beyond OTP: Why Passkeys Are Becoming the New Standard for Internet Trading"},{"content":"Hello Hugo This post records how I set up this blog using Hugo, PaperMod, and GitHub Pages.\n0. The Technology Stack The overall workflow looks like this:\n1. Make sure Hugo version is greater than 0.158.0 Check the Hugo version:\nhugo version 2. Install PaperMod git submodule add --depth=1 https://github.com/adityatelange/hugo-PaperMod.git themes/PaperMod 3. Make a blog directory mkdir d:\\blog 4. In the directory, create Hugo site hugo new site liuguiyu.github.io 5. Edit hugo.toml to be: baseURL = \u0026#39;https://liuguiyu.github.io/\u0026#39; languageCode = \u0026#39;en-us\u0026#39; title = \u0026#39;My Blog\u0026#39; theme = \u0026#39;PaperMod\u0026#39; [params] defaultTheme = \u0026#39;auto\u0026#39; ShowReadingTime = true ShowShareButtons = true ShowPostNavLinks = true ShowCodeCopyButtons = true 6. Create first blog hugo new content/posts/my-first-post.md 7. Edit the blog refer to https://www.markdownguide.org/basic-syntax/\n8. create .gitignore file Make sure the /public folder will never commit to github.\n/public/ /resources/ .hugo_build.lock .DS_Store 9. Verify using git status \u0026amp; git submodule status git status git submodule status 10. Commit for the first time git commit -m \u0026#34;Initial Hugo blog\u0026#34; 11. Connect to remote GitHub repository git remote add origin https://github.com/liuguiyu/liuguiyu.github.io.git git remove -v 12. Git push, triger Github action git push 13. 404 error The site works corretly on localhost, so 404 error normally caused by invalid hugo.yml, try use Hugo recommaned configuration.\n14. GitHub Pages Deployment Failed The GitHub Actions log showed:\nCreating Pages deployment failed and\nstatus: 503 No server is currently available to service your request. The failure happened when GitHub tried to create the Pages deployment. I checked with Copilot, turns out GitHub itself was experiencing an outage.\nrefer to: https://devops.com/github-hit-by-widespread-outage-halting-work-for-global-developers/\n15. Add comments and analysis create \\layouts\\partials\\comments.html and \\layouts\\partials\\extend_footer.html\nfor comments, we can use https://giscus.app/zh-CN\nfor analysis, we can use https://busuanzi.ibruce.info/\n16. Add SEO Go to https://search.google.com/search-console/welcome, add your website, google will generate a html for verification, you will need put the html into \\static folder.\n","permalink":"https://liuguiyu.github.io/posts/my-first-post/","summary":"In this post, I walk through setting up a blog with Hugo and PaperMod and fixing the deployment problems encountered on GitHub Pages.","title":"Building My GitHub Blog with Hugo and PaperMod: From 404 to Deployment"},{"content":"About Me Hi, I\u0026rsquo;m Gary.\nI work in the area of cybersecurity and identity, with a particular focus on Customer Identity and Access Management (CIAM).\nMy work involves operating and improving identity platforms, supporting applications that depend on identity services, and thinking about how authentication, authorization, security, reliability, and user experience come together.\nI\u0026rsquo;m particularly interested in:\nCybersecurity CIAM Identity \u0026amp; Access Management Ping Identity FIDO2 \u0026amp; Passkeys Authentication \u0026amp; Authorization AI and developer tools Security operations and observability About This Blog I started this blog as a place to document things I learn, problems I encounter, and ideas that I find interesting.\nSome posts will be practical notes from real-world technology and security work. Others may be explorations of new technologies, tools, or concepts.\nThe goal is simple:\nLearn something → understand it → write it down → share it.\nI also believe that writing is one of the best ways to discover what you actually understand — and what you don\u0026rsquo;t.\nWhat You\u0026rsquo;ll Find Here The main topics of this blog are:\nSecurity\nCybersecurity, security architecture, risk, and practical security engineering.\nIdentity\nCIAM, IAM, authentication, authorization, FIDO2, Passkeys, and identity platforms.\nAI\nAI tools, AI-assisted development, LLMs, and experiments with emerging technologies.\nTechnology\nDeveloper tools, infrastructure, automation, and things I build or learn along the way.\nKeep in Touch You can find my projects and experiments on GitHub:\nGitHub\n","permalink":"https://liuguiyu.github.io/about/","summary":"\u003ch2 id=\"about-me\"\u003eAbout Me\u003c/h2\u003e\n\u003cp\u003eHi, I\u0026rsquo;m Gary.\u003c/p\u003e\n\u003cp\u003eI work in the area of \u003cstrong\u003ecybersecurity and identity\u003c/strong\u003e, with a particular focus on \u003cstrong\u003eCustomer Identity and Access Management (CIAM)\u003c/strong\u003e.\u003c/p\u003e\n\u003cp\u003eMy work involves operating and improving identity platforms, supporting applications that depend on identity services, and thinking about how authentication, authorization, security, reliability, and user experience come together.\u003c/p\u003e\n\u003cp\u003eI\u0026rsquo;m particularly interested in:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eCybersecurity\u003c/li\u003e\n\u003cli\u003eCIAM\u003c/li\u003e\n\u003cli\u003eIdentity \u0026amp; Access Management\u003c/li\u003e\n\u003cli\u003ePing Identity\u003c/li\u003e\n\u003cli\u003eFIDO2 \u0026amp; Passkeys\u003c/li\u003e\n\u003cli\u003eAuthentication \u0026amp; Authorization\u003c/li\u003e\n\u003cli\u003eAI and developer tools\u003c/li\u003e\n\u003cli\u003eSecurity operations and observability\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2 id=\"about-this-blog\"\u003eAbout This Blog\u003c/h2\u003e\n\u003cp\u003eI started this blog as a place to document things I learn, problems I encounter, and ideas that I find interesting.\u003c/p\u003e","title":"About"}]