I sort of started skimming when the article was saying industry solved the problem with text messages and TOTP. I think there are several arguable problems with Passkeys as implemented, but to argue TOTP is equivalent is going to leave lots of people vulnerable.

The protections against MITM you mentioned is probably the biggest one, but the other one in the back of my mind is TOTP is a shared secret. So a compromise of the server side allows impersonation of users undetected, which can be a big problem. Maybe I'm over reacting because no company has ever lost a copy of it's database and they're all super secure. But, imagine trying to argue as a user I didn't do a thing when there is an audit log saying we challenged the user for TOTP and it was provided, was definitely the users fault.

▲

danpalmer 4 hours ago | parent | next [-]

TOTP is this decade's "just have a better password", and we all know how well that went before.

▲

cromka 3 hours ago | parent | prev [-]

> solved the problem with text messages

Especially considering how easy it still is to do a SIM swap.

	▲	ggm 2 hours ago \| parent \| next [-]
		Highly economy specific. Ease varies by nation state. Social engineering attacks in Australia are far LESS common than they used to be and I believe other economies in Asia and Europe all have less than the USA. If you aren't talking from a US perspective, where are you that SIM swap is a low bar?
	▲	ButlerianJihad an hour ago \| parent \| prev [-]
		> Especially considering how easy it still is to do a SIM swap. Heh. Several months ago, I found myself in need of a new phone. I even had the means to do an orderly transition, with the old one still in hand and mostly working. My mobile provider was an MVNO that was also my home ISP. I had enabled "enhanced security" to prevent ev0l hackerz from swapping my SIM without authorization. It turns out that this mode is so secure that it prevented me and the support staff from a normal upgrade procedure. There were various glitches along the way, and a conversation with certain LLMs indicated that the SIM->eSIM disparity was also causing trouble, and with the online system's rejection of authentication I decided it was expedient to walk into their nearby storefront location. It turns out that the salespeople in the storefronts are not really empowered in any technical way, except they were quite capable of changing my password without any reason, and wasting my time, so leaving the store empty-handed after mind games from three haughty female STEM dropouts was rather infuriating. The process eventually succeeded after giving it a little time, space, and grace, but it looks like I'm leaving "enhanced security" disabled if it's so customer-hostile.