Comment by advisedwang

I wish people would stop pretending TOTP is an adequate solution over passkeys. TOTP provides no defense against phishing, one of the most common ways people get compromised. WebAuthn (and passkeys) make phishing virtually impossible. If you want to convince folks not to use passkeys, you've got to at least recommend something with parity, ie fido.