alt Hacker NewsYep, the king is currently SMS, which isn't good.
I like passkeys, but somewhere between websites and browsers, even those aren't used in a consistent way. And idk why there are so many prompts before you're actually logged in with one. The name is also unclear.
TOTP is way worse. It used to be kinda synonymous with Google Authenticator which had insane footguns for losing your codes. Now it's just inconsistent and weird. Like I was trying to set up Github 2FA with 1password, it wanted me to scan a QR code with the browser extension, that wasn't working, so I had to copy some other code instead and paste it into some deep hidden menu of 1password that I needed a tutorial to find. I almost did SMS instead. Most people probably will.
Also don't know why Github requires TOTP or SMS even if you already have a passkey. Probably goes back to passkeys not being mature yet.
A very odd real example is how Sony went backwards with passkey compatibility on their apps. It's I think what happened when they tried to have a single OIDC setup instead of multiple (PSN was a totally separate setup for the longest time and had it solved, but other parts of Sony, on a separate system, was almost wholly incompatible. The merging of the two made it impossible for their current webkit implementations to detect passkeys in say your 1password when it was working like a charming for years on PSN). This kind of stuff happens but to put it into production when it's almost immediately obvious that they screwed up is pretty wild.