> So now if the database is exfiltrated by a hacker without anyone noticing, he still couldn't produce tokens to log in as a user. Why not? With TOTP, you typ

> So now if the database is exfiltrated by a hacker without anyone noticing, he still couldn't produce tokens to log in as a user. Why not? With TOTP, you type in a short code. The server needs to also be able to generate this code so they can verify that your code is correct. If it only has the public key then it must be able to produce the tokens to login as the user. If you want a more complex setup where the public key can only verify that the code is valid but cannot be used to create valid codes then the codes themselves (and the protocol) become considerably more complex and aren't going to be managed by a "type six digits into a web form" UX. I also don't think this really matters in a major sense. If somebody pwns the credential database then continuing to rely on authentication to prevent further harm is a fool's errand. "The adversary only got to extract the credential database and achieved nothing else" is not an especially common scenario today.