TOTP is a great solution.
It is?
So what makes passkeys so different? Well, they look very similar to TOTP on the surface. Both have an open standard (RFC 6238 for TOTP, WebAuthn for passkeys), so surely passkeys must have all these same nice properties as TOTP, right? At first glance it would seem so.
Donāt forget that unlike passwords and SMS codes and TOTP, passkeys are designed to function in the background without you ever seeing the details.
Wait for Big Tech to propose something just as convenient and secure but more clearly defined and with fewer strings attached. In the meantime if you want security, your Game Boy can provide you with TOTP.
It really seems like the article is drawing a strong distinction between TOTP and passkeys and saying TOTP is better though
Implementations.
What FIDOA decides to passkey and you with your website are totally different security agendas. The Hack goes into detail how corporations can refuse several of your passkey settings.
They are not different implementations, they are completely different things. TOTP can't have remote attestation or settings, it's just a code. Passkeys are something else, that has some similarities (also generating a time-based code).
@lemmy.bestiver.se
Posts from the RSS Feed of HackerNews.
The feed sometimes contains ads and posts that have been removed by the mod team at HN.
go to feed...
@lemmy.bestiver.se
Posts from the RSS Feed of HackerNews.
The feed sometimes contains ads and posts that have been removed by the mod team at HN.
go to feed...
I wouldn't be surprised if five years down the line companies figure out a way to use pass keys as a way to de-anonymize and track people.
save