- Describing TOTP as a “great solution” for adding security to a password-based account. When the most common threat model on the web is phishing (a word the post never mentions!), TOTP hardly buys you anything. TOTP is phishable.
If (after decades of awareness) you manage to get phished while using TOTP, you shouldn’t be trusted with a phone or any digital information at all



I didn’t know of this, I still prefer the control TOTP gives you but yeah, that makes an argument for the passkeys I guess.