Oct 12, 2026, 12:10 PMRE: https://hachyderm.io/@mlabowicz/117427835711192104
If you're deftly sidestepping passkeys at every turn, like me, but you're concerned about your TOTP codes being stuck in Google Authenticator, worry not: I wrote a tutorial last year on how to #Degoogle your TOTP codes and extract the secrets: https://imrannazar.com/articles/degoogle-otp
@Two9A Hi, passkey-sidestepping friend! I de-googled my TOTP years ago the hard way; good to know there is an easier way now! (I think I'm on my third or fourth generation of codes now... and this one has downloadable code keys!)
@Two9A I'd appreciate a more … concise …explanation of what's wrong with passkeys. As near as I can follow from the non-functional blog, the objections are: businesses want you to use them, it's difficult to share passkeys, and 2fa with text messages and email are much better. (I think 2fa is better, but text messages or email are not secure 2fa and no one should be recommending those.)
Oct 12, 2026, 1:57 PM@thudfactor There's a (fairly lengthy) discussion of the article over on Orangesite: https://news.ycombinator.com/item?id=50048312
But the gist is: passkeys support remote attestation of the device storing the key, and a site that uses passkeys can upgrade your authentication to require attestation, locking you out if you try to auth from a device that isn't "genuine" (like my Graphene phone, say) or "licensed" (with a government ID attached).
And to summarise the discussion, it's mostly around how sneaky the sites would be in performing that upgrade of your passkey.
@Two9A Aha! Very useful and also concerning. And you were able to do it in less than 9000 words, thanks!