It fails for somebody every day, it adds a dependency for a known unreliable 3rd party that often mangles the identification data it sends back, it is exploited by that 3rd party for extending their monopoly, and it gives that 3rd party (or any hacker that got access to them) full access to impersonate any user it wants.
That’s the user’s choice, that should not be a consideration when choosing authentication methods as long as you tell them how to store it properly (in a reasonable way, probably shouldn’t mention keepass or anything like that).
in a reasonable way, probably shouldn’t mention keepass or anything like that
I avoid all those big tech sites advocating passkeys in recent times anyway, so I did not really have much chance to test it. But my password manager at least seems to be able to properly store and backup passkeys. It’s the import/export should I want to use other software that seems to be universally lacking still.
Who doesn’t use TOTP/HOTP? The brain-less part usually comes into play when they then recommed (or even require…) propietary shit like Google’s authenticator app as if there weren’t enough secure and open source options.
Amazon, Facebook, and many more support TOTP in whatever authenticator you want. I don’t particularly like either of those websites but they are massive and directly contradict your claim that no corporation uses this normal method of 2FA.
It fails for somebody every day, it adds a dependency for a known unreliable 3rd party that often mangles the identification data it sends back, it is exploited by that 3rd party for extending their monopoly, and it gives that 3rd party (or any hacker that got access to them) full access to impersonate any user it wants.
What?
Implement TOTP and let your users use their preferred authenticator and none of what you’re struggling with will apply.
Which also means you can just copy/paste it alongside username and password with the same manager.
👆️
That’s the user’s choice, that should not be a consideration when choosing authentication methods as long as you tell them how to store it properly (in a reasonable way, probably shouldn’t mention keepass or anything like that).
I avoid all those big tech sites advocating passkeys in recent times anyway, so I did not really have much chance to test it. But my password manager at least seems to be able to properly store and backup passkeys. It’s the import/export should I want to use other software that seems to be universally lacking still.
Oh, yeah, and of course there’s someone on the internet talking about the MFA protocol that no corporation uses.
That one is obligatory too.
(Anyway, yes, if you need MFA, use TOTP. That’s a non-brainier. Except that corporations don’t have brains.)
Who doesn’t use TOTP/HOTP? The brain-less part usually comes into play when they then recommed (or even require…) propietary shit like Google’s authenticator app as if there weren’t enough secure and open source options.
Amazon, Facebook, and many more support TOTP in whatever authenticator you want. I don’t particularly like either of those websites but they are massive and directly contradict your claim that no corporation uses this normal method of 2FA.