The authors concern is primarily about attested and user-verified passkeys.

you are viewing a single comment's thread
view the rest of the comments
[–] 15 points 3 days ago*

TOTP is great and works great. I can maybe see passkeys for an org where they want control over access at an org level, but at that point you're probably using Kerberos or something.

This is a solution in search of a problem (the problem being people sharing passwords for services)

  • source