Keep reading. The Hack explains how corporations can arbitrate which type of passkeys they might allow when their TOTP authenticator refuses your passkey settings.
So what makes passkeys so different? Well, they look very similar to TOTP on the surface. Both have an open standard (RFC 6238 for TOTP, WebAuthn for passkeys), so surely passkeys must have all these same nice properties as TOTP, right? At first glance it would seem so.
Don’t forget that unlike passwords and SMS codes and TOTP, passkeys are designed to function in the background without you ever seeing the details.
Wait for Big Tech to propose something just as convenient and secure but more clearly defined and with fewer strings attached. In the meantime if you want security, your Game Boy can provide you with TOTP.
It really seems like the article is drawing a strong distinction between TOTP and passkeys and saying TOTP is better though
Implementations.
What FIDOA decides to passkey and you with your website are totally different security agendas. The Hack goes into detail how corporations can refuse several of your passkey settings.
They are not different implementations, they are completely different things. TOTP can’t have remote attestation or settings, it’s just a code. Passkeys are something else, that has some similarities (also generating a time-based code).
Keep reading. The Hack explains how corporations can arbitrate which type of passkeys they might allow when their TOTP authenticator refuses your passkey settings.
It really seems like the article is drawing a strong distinction between TOTP and passkeys and saying TOTP is better though
Implementations.
What FIDOA decides to passkey and you with your website are totally different security agendas. The Hack goes into detail how corporations can refuse several of your passkey settings.
They are not different implementations, they are completely different things. TOTP can’t have remote attestation or settings, it’s just a code. Passkeys are something else, that has some similarities (also generating a time-based code).