Comment by nonfunctional
8 days ago
My understanding is that TOTP and physical security keys both share very little information about you. Perhaps passkeys, being part of a standard that the FIDO Alliance keeps updating, may some day be expected to reveal considerably more information. And the limited number of remote-attestation-approved passkey managers might someday all start start volunteering such information regardless.
For starters, AAGUID already reveals the passkey provider. It can be spoofed without attestation, but good faith (debatable choice of phrase obviously) users already reveal more about themselves, a fair bit more depending on who you ask and how unusual the choice of passkey provider is.