The ability to ban perfectly good software from being used is reducing user choice. It goes against those very ideals: possibilites and consensus. We should not adopt software paradigms that are counter to those.
TOTP is already 'good'. Passkeys are worse because of bullshit like this.
Smells like FUD. Who's providing the ability to ban software? Providers are free to implement authentication requirements like SDC vs MDC the same way they can enforce minimum password entropy or maximum password age.
In practice I'm aware of more 'lock in' behavior in the form of restricting which TOTP client is accepted than for Passkeys. There are many more bespoke 'Authenticator' apps than there are passkey implementations, many of which disallow registering codes in third party wallets.
Bitwarden also syncs TOTP. Given it's the same client, why push folks to opt for a provably weaker protocol with higher potential for user harm?
The internet is built on possibilities and sustained through consensus. Don't let perfect be the enemy of the good.
The ability to ban perfectly good software from being used is reducing user choice. It goes against those very ideals: possibilites and consensus. We should not adopt software paradigms that are counter to those.
TOTP is already 'good'. Passkeys are worse because of bullshit like this.
Smells like FUD. Who's providing the ability to ban software? Providers are free to implement authentication requirements like SDC vs MDC the same way they can enforce minimum password entropy or maximum password age.
In practice I'm aware of more 'lock in' behavior in the form of restricting which TOTP client is accepted than for Passkeys. There are many more bespoke 'Authenticator' apps than there are passkey implementations, many of which disallow registering codes in third party wallets.
Bitwarden also syncs TOTP. Given it's the same client, why push folks to opt for a provably weaker protocol with higher potential for user harm?
3 replies →