Comment by ttul
8 days ago
TOTP is susceptible to man in the middle attacks. Passkeys are not. That alone is a solid reason to favor Passkeys!
8 days ago
TOTP is susceptible to man in the middle attacks. Passkeys are not. That alone is a solid reason to favor Passkeys!
The objection is not against using keys for authentication, it's against the standard including attestation provisions, because there is an incredibly large space for abusing these to limit user freedom.
BigTech doesn't need attestations in the passkey spec to limit freedom.
Attestations were added so that highly specific domains where attestation is required (by law, a regulator etc.) can still use the same passkey spec as everyone else without having to invent their own thing.
If there was benefit to BigTech of locking in Auth to a specific device, they'd have done it long ago - it's not difficult.
Where is it required? If the answer is "nowhere before, but now that passkeys support it, places are starting to", then that's an argument that it's bad, not that it's good. And being able to "use the same passkey spec as everyone else without having to invent their own thing" is bad. I want them to all have to invent their own, so that most of them will make mistakes that let the attestation be bypassed and freedom be restored.
1 reply →
sure, and some planes still crash, but that's still not reason why I will stop flying (using TOTP), it's about odds, I've never heard about TOTP MITM attack in few EU countries I read news from daily, it's unheard thing, only heard about it in US with crap identity verification