Keep reading. The Hack explains how corporations can arbitrate which type of passkeys they might allow when their TOTP authenticator refuses your passkey settings.
So what makes passkeys so different? Well, they look very similar to TOTP on the surface. Both have an open standard (RFC 6238 for TOTP, WebAuthn for passkeys), so surely passkeys must have all these same nice properties as TOTP, right? At first glance it would seem so.
Don’t forget that unlike passwords and SMS codes and TOTP, passkeys are designed to function in the background without you ever seeing the details.
Wait for Big Tech to propose something just as convenient and secure but more clearly defined and with fewer strings attached. In the meantime if you want security, your Game Boy can provide you with TOTP.
It really seems like the article is drawing a strong distinction between TOTP and passkeys and saying TOTP is better though
Implementations.
What FIDOA decides to passkey and you with your website are totally different security agendas. The Hack goes into detail how corporations can refuse several of your passkey settings.
I wouldn’t be surprised if five years down the line companies figure out a way to use pass keys as a way to de-anonymize and track people.
Why? Just give them another passkey.
Usage isolation is 🥁 key.
The article is about the weakness of TOTP, not passkeys themselves.
It is?
Keep reading. The Hack explains how corporations can arbitrate which type of passkeys they might allow when their TOTP authenticator refuses your passkey settings.
It really seems like the article is drawing a strong distinction between TOTP and passkeys and saying TOTP is better though
Implementations.
What FIDOA decides to passkey and you with your website are totally different security agendas. The Hack goes into detail how corporations can refuse several of your passkey settings.