3 ms·
TOTP is a much simpler, more universal solution --- easily transferable and totally independent of any OS or device. Too many poorly addressed problems with pa
by jqpabc123 2y ago
TOTP is a much simpler, more universal solution --- easily transferable and totally independent of any OS or device.
Too many poorly addressed problems with passkeys. For example, what happens if my device is lost/stolen or simply breaks/dies?
With TOTP, backups are easy and can even be done on paper if desired.
- riya_hawcx 2y agoTOTP is simple, universal, and relatively easy to back up, even on paper as you mentioned. However, it does have its limitations, particularly in terms of security. One of the main issues with TOTP is that it still relies on shared secrets, which are vulnerable to being stolen or intercepted if the database storing those secrets is compromised. Phishing attacks are on a significant rise and can also trick users into sharing their OTPs, especially with advanced social engineering tactics. Plus, if someone gains access to your phone or authenticator app, they can bypass the OTP altogether. Passkeys, on the other hand, eliminate the need for shared secrets entirely by relying on asymmetric cryptography (public-private keys). Even if a hacker intercepts part of the communication, they can't do much without the private key, which never leaves the user's device. The main challenge with passkeys right now is OS dependency and device/account recovery.
- jqpabc123 2y agoHowever, it does have its limitations, particularly in terms of security. Is this a problem that actually needs fixing in the real world? Most "real world" exploits I am aware of regarding TOTP center around SMS vulnerabilities. For which there is a simple and obvious fix --- don't use SMS. Instead, generate codes locally. If TOTP is too difficult, will passkeys be any better?