Post by @pulsewidth@lemmy.world

2026-10-14 11:30 UTC

I swear most people have forgotten what TOTP was used for in the first place - two-factor auth to protect people re-using passwords getting hit by password breaches on other services, people using low complexity passwords, and to protect people’s from breeched devices. Eg computers getting viruses or malware that gives the attacker access to your credentials. In short, to solve some poor security practices. And 2FA via TOPT still solves all of those problems. Passkeys fix a different problem. On their own as a technology they essentially just increase the quality of a password, while tying that password to a single device. So they fix the problems of re-used passwords, and unsophisticated passwords. But with many implementations they fall back to being single-factor auth - if a user has access to your device, they can use the passkey (with exceptions such as passkeys stored on a physical second-factor like a Yubikey that requires physical approval to use). TOTP meanwhile requires two devices to be accessed by design. As myself and most tech-aware users already use unique, sophisticated passwords - they don’t solve a problem for us. However, if businesses allow passkeys as a simple password alternative, while still allowing TOTP as a second factor, I’d be happy to do so for critical access items (mostly banking). However, I’m not aware of this being the case for any common implementations in major businesses. Passkeys are just ‘Yubikey without the Yubikey or physical approval’ - pointless to me. False sense of security even.

Replies (2)

@Ooops@feddit.org 2026-10-14 13:41

Passkeys fix a different problem. In my eyes the problem is that passkeys do not fix a problem. They just shift it to another layer… I can backup a password however I like. I can backup a TOTP authenticator (or specifically the secret that works with every one of them) however I like. I can not however backup a hardware device with my passkey. And the websites supporting passkeys obviously know it and explicitly warn when you don’t have an alternative way of logging in configured as it’s pssible that sinple hardware damage or loss locks you out of your account. Thus the “fix for a problem” is now relegated to a shiny new way of conveniently pressing the button on a key instead of typing and remembering passwords, while the actual attack surface is still there but now sitting in alternative login/account recovery instead.

Open ##5030142
@IanTwenty@piefed.social 2026-10-14 20:22

Maybe one extra thing you are missing is passkeys are resistant (not proof) to phishing. The user returns an ‘assertion’ that: uses the private key to digitally sign a challenge value from the server, together with contextual information such as the requesting origin https://developer.mozilla.org/en-US/docs/Web/Security/Authentication/Passkeys It useless to pretend to be the bank as you’ll get an assertion from the user you can’t replay and the user’s passkey implementation should spot the origin is wrong and refuse to sign it anyway (as I understand it).

Open ##5035220