> A combination of randomly generated passwords stored inside a third-party password manager, paired with an independent TOTP app, gives control to the user without giving up the flexibility of plain text.

No grandma, don’t use the unphishable one-click passkey setup that syncs across all your devices. Instead, install a third-party password manager (no, no, not the one built in to your device or browser), then another TOTP app on your phone. It’s slower and more susceptible to phishing, but uhhh, what if you’re among the one in a million people that has their Google or Apple account wrongly banned?

▲

Whitespace an hour ago | parent | next [-]

> syncs across all your devices

My Macbook can sync passkeys from my Android phone?

	▲	bennetthilberg an hour ago \| parent [-]
		Yes, there are several ways. You can use Google password manager on your MacBook. I believe 1Password and Bitwarden support this too. You can also use the Android phone itself as a passkey device with the QR code flow. The UX is obviously a lot smoother if you have an iPhone and use iCloud keychain for everything, but that’s not an uncommon setup.

▲

unethical_ban 2 hours ago | parent | prev [-]

Infosec for 15 years, and I do not want passkeys either. Anything that attaches itself to hardware is susceptible to loss. Anything that attaches itself to hardware makes it harder to use services from a new device.

At some layer you have be able to access your services with password/totp if only for recovery. Passkeys add a layer for minimum benefit, in my opinion.

Yes, push based totp and passkeys are more phish proof but for non techies, managing them is its own job.