Comment by ak6te
7 days ago
> That's not a good enough reason to recommend TOTP instead
In what way is TOTP an "instead"? My understanding of passkeys is that they basically replace the username/password combo, but do not provide any kind of second factor. I know at least one service (I think Amazon, but I'm not 100% sure) still requires TOTP when logging in with a passkey from an unrecognized device.
TOTP also does not imply a second factor, it's just a time-based password calculated from a shared secret that can be stored anywhere, for example in your password manager alongside the username and password. And worse than your password, of which only a hash should be stored at the service you have an account with, they store the shared secret too (which can thus be leaked from their side), so TOTP is never fully hardware-bound, it always exists in at least two places. Passkeys _can_ be fully hardware-bound, with the secret only existing in the secure chip of your phone or hardware security key for example, not at any moment in its lifecycle exposed to user, service or potential attacker.
> Amazon (..) still requires TOTP when logging in with a passkey from an unrecognized device.
I noticed Amazon does that and it annoyed me greatly.
My understanding is that the passkey branding is specifically for copyable, user-verified keys. So the second factor is the biometrics (or equivalent) of your device. But yeah there doesn’t seem to be consensus yet about still requiring TOTP with passkeys.