> That's not a good enough reason to recommend TOTP instead
In what way is TOTP an "instead"? My understanding of passkeys is that they basically replace the username/password combo, but do not provide any kind of second factor. I know at least one service (I think Amazon, but I'm not 100% sure) still requires TOTP when logging in with a passkey from an unrecognized device.
In what way is TOTP an "instead"? My understanding of passkeys is that they basically replace the username/password combo, but do not provide any kind of second factor. I know at least one service (I think Amazon, but I'm not 100% sure) still requires TOTP when logging in with a passkey from an unrecognized device.