All the rest of this argument just misses me. Whatever the non-phishable authentication you want to use is, that's fine by me. But TOTP is phishable, eminently so, so you're not going to see security people back down from deprecating it.

▲

AnthonyMouse a day ago | parent [-]

Then they need to advance an alternative that doesn't support remote attestation.

	▲	tptacek a day ago \| parent [-]
		I think the arguments about attestation are bogus for all the reasons everyone else is pointing out but that doesn't matter because I'm not talking about Passkeys, I'm talking about why TOTP is a dead letter. You're not going to get security people to back down on deprecating TOTP, because it's phishable, and the point of modern authentication protocols is defeat that attack. By all means, keep lobbying against Passkeys! I don't care. But you'd be shooting yourself in the foot rhetorically to build TOTP into your case, as the comment I replied to originally just did.