TOTP is simple, universal, and relatively easy to back up, even on paper as you mentioned. However, it does have its limitations, particularly in terms of secur

TOTP is simple, universal, and relatively easy to back up, even on paper as you mentioned. However, it does have its limitations, particularly in terms of security. One of the main issues with TOTP is that it still relies on shared secrets, which are vulnerable to being stolen or intercepted if the database storing those secrets is compromised. Phishing attacks are on a significant rise and can also trick users into sharing their OTPs, especially with advanced social engineering tactics. Plus, if someone gains access to your phone or authenticator app, they can bypass the OTP altogether. Passkeys, on the other hand, eliminate the need for shared secrets entirely by relying on asymmetric cryptography (public-private keys). Even if a hacker intercepts part of the communication, they can't do much without the private key, which never leaves the user's device. The main challenge with passkeys right now is OS dependency and device/account recovery.