3 ms·
That "no" is not so unequivocal. TOTPs have two use cases... 1) to prevent replay attacks, 2) as a second factor. While passkeys do the same as TOTPs for #1,
by jbotz 3y ago
That "no" is not so unequivocal. TOTPs have two use cases... 1) to prevent replay attacks, 2) as a second factor. While passkeys do the same as TOTPs for #1, they don't by themselves address #2. You may still want to use a TOTP that's generated by a separate device (physically different from your primary device) for #2. Of course if you're using the same password manager to handle both passkeys and generate TOTPs and have that on all your devices then your TOTP wouldn't be a real second factor. Ideally here you'd use one of those TOTP-only devices such as those old RSA "credit cards".
- cassianoleal 3y agoIsn't the whole point of a second factor to prevent a replay attack / credential stuffing?
- rcaught 3y agoWhat? Passkeys support separate physical devices if you want.
- ngrilly 3y agoThe question was "do *you* still use TOTP when using passkeys". I answered "no" because *I* don't use TOPT with my passkeys, but I'm not saying it's not possible or that you shouldn't do it. Personally, as my keys are stored on a physical device, and are unlocked using my biometrics, I consider this as two factors. But I can see how others would prefer two different physical devices.