Comment by seemaze
5 days ago
>I've never seen this before
Microsoft, Apple, Adobe, Cisco, Steam to name a few.
>It's just my opinion
Fair enough. I find TOTP to be a PITA. I share your ire with user hostile platforms, but I see the passkey protocol as a net benefit to the status quo. It's unclear how a platform's choice to use a stricter version of the protocol is any different than their choice not to implement RFC 6238 at all.
> Microsoft, Apple, Adobe, Cisco, Steam to name a few.
I use normal TOTP with Microslop. Presumably you can opt into a worse version if you use their enterprise software, if you're evil or whatever.
The rest I presume fall into the bucket of 'wants to cause their users pain and suffering'. That's the normal modus operandi for Adobe and Cicso at least. The only one of those I use is Steam, and I haven't needed to log into Steam in over 2 years, since I'm just always logged in. Fair point though.
> Fair enough. I find TOTP to be a PITA.
I do too. Yet passkeys manage to be even more of a pain in the ass with ominous potential consequences on the horizon. If it was TOTP plus some phishing resistance without any actual downside, I'd have no beef. If it was TOTP but simpler, then there's be negative beef. There are however several clear and present downsides to passkeys. That just makes for a worse tradeoff (depending on your values) rather than a genuine improvement.