Hacker News Reader

Duo lets you use a physical security key, I then use bitwarden to store that as a passkey. Not quite a full replacement but good enough for me (you can also self host bitwarden [0])

[0] Vaultwarden

Aegis will happily slurp the secrets out from Duo on a rooted device.

Some organizations disable totp entirely. Instead, everytime there's a login attempt a pop-up notification with "allow" & "deny" options is pushed to the registered device.

TOTPs are inherently less secure than many of these proprietary solutions (they don't offer control over where people store them and whether they create backups of them, for one thing), so I do somewhat understand companies preferring those.

I agree that "TOTP with user held keys offer relatively more control to the user than to the organization," but I would never call this "inherently less secure."

Just a different kind of insecure.