Crossposted from https://feddit.org/post/36692057

A rebuttal to an anti-passkey, pro-TOTP post that has made the rounds on Lemmy as well.

you are viewing a single comment's thread
view the rest of the comments
[–] 4 points 6 hours ago* (2 children)

I swear most people have forgotten what TOTP was used for in the first place - two-factor auth to protect people re-using passwords getting hit by password breaches on other services, people using low complexity passwords, and to protect people's breeched devices (e.g. computers getting viruses or malware or drive-by credential nabbers that give the attacker access to your credentials in some way). In short, to solve some poor security practices. 2FA via TOPT still solves all of those problems.

Passkeys fix a different problem. On their own as a technology they essentially just increase the quality of a password, while tying that password to a single device. So they fix the problems of re-used passwords, and unsophisticated passwords. But with many implementations they fall back to being single-factor auth - if a user has access to your device, they can use the passkey (with exceptions such as passkeys stored on a physical second-factor like a Yubikey that requires physical approval to use).

TOTP meanwhile requires two devices to be accessed by design.

As myself and most tech-aware users already use unique, sophisticated passwords - they don't solve a problem for us.

However, if businesses allow passkeys as a simple password alternative, while still allowing TOTP as a second factor, I'd be happy to do so for critical access items (mostly banking). However, I'm not aware of this being the case for any common implementations in major businesses.

Passkeys are just 'Yubikey without the Yubikey or physical approval' - pointless to me. False sense of security even.

  • source
  • hideshow 2 child comments
  • [–] 2 points 4 hours ago* (1 child)

    Passkeys fix a different problem.

    In my eyes the problem is that passkeys do not fix a problem. They just shift it to another layer...

    I can backup a password however I like. I can backup a TOTP authenticator (or specifically the secret that works with every one of them) however I like.
    I can not however backup a hardware device with my passkey.

    And the websites supporting passkeys obviously know it and explicitly warn when you don't have an alternative way of logging in configured as it's possible that simple hardware damage or loss locks you out of your account. Thus the "fix for a problem" is now relegated to a shiny new way of conveniently pressing the button on a key instead of typing and remembering passwords, while the actual attack surface is still there but now sitting in alternative login/account recovery instead.

  • source
  • parent
  • hideshow 1 child comment