This is a very badly written article that conflates TOTP with passwords and then uses that to try to draw a line between totp and passkeys. Passkeys are limited in use in the exact same way that password are. The entity making the website gets to decide the rules.
Attested passkeys will not happen for common big tech websites because they wouldn’t completely prevent the use of password managers.
All these companies are pushing for passkeys because they not only are vastly better for security, but because they remove liability for these companies.
The author falls down the steepest slope I’ve ever seen writing this article, and still fails to see the basic facts.
This is a very badly written article that conflates TOTP with passwords and then uses that to try to draw a line between totp and passkeys. Passkeys are limited in use in the exact same way that password are. The entity making the website gets to decide the rules.
Attested passkeys will not happen for common big tech websites because they wouldn’t completely prevent the use of password managers.
All these companies are pushing for passkeys because they not only are vastly better for security, but because they remove liability for these companies.
The author falls down the steepest slope I’ve ever seen writing this article, and still fails to see the basic facts.