4 ms·

Do sites generally allow you to have passkeys and passwords set at the same time for the same account? Do you still use TOTP when using passkeys? I guess I wi

by raybb 3y ago

Do sites generally allow you to have passkeys and passwords set at the same time for the same account? Do you still use TOTP when using passkeys? I guess I will try a passkey today and see how I feel about it. Bummer that it won't work with bitward and mobile yet. If anyone else is curious, I found this site that shows which websites are supporting passkeys. https://passkeys.directory/ https://passkeys.directory/

jackson1442 3y ago
> Do sites generally allow you to have passkeys and passwords set at the same time for the same account? Typically, yes. You can do this today with Github and Google accounts (and certainly at least a few others). The password option might instead be a link in your email or something similar on other websites, but generally I’ve seen it recommended to have at least one other option to get into your account.
ngrilly 3y ago
> Do sites generally allow you to have passkeys and passwords set at the same time for the same account? In my experience, yes. > Do you still use TOTP when using passkeys? No.
- jbotz 3y ago
  That "no" is not so unequivocal. TOTPs have two use cases... 1) to prevent replay attacks, 2) as a second factor. While passkeys do the same as TOTPs for #1, they don't by themselves address #2. You may still want to use a TOTP that's generated by a separate device (physically different from your primary device) for #2. Of course if you're using the same password manager to handle both passkeys and generate TOTPs and have that on all your devices then your TOTP wouldn't be a real second factor. Ideally here you'd use one of those TOTP-only devices such as those old RSA "credit cards".
  - cassianoleal 3y ago
    Isn't the whole point of a second factor to prevent a replay attack / credential stuffing?
  - rcaught 3y ago
    What? Passkeys support separate physical devices if you want.
  - ngrilly 3y ago
    The question was "do *you* still use TOTP when using passkeys". I answered "no" because *I* don't use TOPT with my passkeys, but I'm not saying it's not possible or that you shouldn't do it. Personally, as my keys are stored on a physical device, and are unlocked using my biometrics, I consider this as two factors. But I can see how others would prefer two different physical devices.

by raybb 3y ago

jackson1442 3y ago

> Do sites generally allow you to have passkeys and passwords set at the same time for the same account? Typically, yes. You can do this today with Github and Google accounts (and certainly at least a few others). The password option might instead be a link in your email or something similar on other websites, but generally I’ve seen it recommended to have at least one other option to get into your account.

ngrilly 3y ago

> Do sites generally allow you to have passkeys and passwords set at the same time for the same account? In my experience, yes. > Do you still use TOTP when using passkeys? No.

jbotz 3y ago
That "no" is not so unequivocal. TOTPs have two use cases... 1) to prevent replay attacks, 2) as a second factor. While passkeys do the same as TOTPs for #1, they don't by themselves address #2. You may still want to use a TOTP that's generated by a separate device (physically different from your primary device) for #2. Of course if you're using the same password manager to handle both passkeys and generate TOTPs and have that on all your devices then your TOTP wouldn't be a real second factor. Ideally here you'd use one of those TOTP-only devices such as those old RSA "credit cards".
- cassianoleal 3y ago
  Isn't the whole point of a second factor to prevent a replay attack / credential stuffing?
- rcaught 3y ago
  What? Passkeys support separate physical devices if you want.
- ngrilly 3y ago
  The question was "do *you* still use TOTP when using passkeys". I answered "no" because *I* don't use TOPT with my passkeys, but I'm not saying it's not possible or that you shouldn't do it. Personally, as my keys are stored on a physical device, and are unlocked using my biometrics, I consider this as two factors. But I can see how others would prefer two different physical devices.