6
Security
Passkeys vs passwords + TOTP for a B2B SaaS login
Security ↔ Support load
Context
Replace password-only login after a credential-stuffing incident.
Last month we had a credential-stuffing incident: 140 accounts accessed with passwords leaked from another site. Password-only login has to go.
Option A is passkeys first: offer passkeys at sign-in, nudge everyone to enrol, keep passwords as a fallback for a while.
Option B is the familiar passwords + TOTP authenticator apps, which every customer's IT team already understands.
Complication: some customers run warehouses where several people share one Windows PC.
Constraints
- Users
- 45K across 900 companies
- SSO
- 30% of customers
- Devices
- Shared warehouse PCs
Passkeys firstvsPasswords + TOTP
Community verdict
Passkeys first 63%Passwords + TOTP 37%
8 engineers · 4 opinions
With these constraints, what would you choose?
One choice per engineer. You can change it any time.
Passkeys first
Passwords + TOTP
Familiarity →
Trade-offs
Dimensions
Passkeys firstPasswords + TOTPout of 5
- Phishing resistance
- 5Passkeys first scores 5 of 52Passwords + TOTP scores 2 of 5
- Familiarity
- 2Passkeys first scores 2 of 55Passwords + TOTP scores 5 of 5
- Shared devices
- 2
Community discussion
4 comments
Have you made this decision in production? Share your reasoning.
Sign in to commentAccount recovery is where both options fail if you don't design it. Our support tickets after launching passkeys were 90% "new phone, can't log in". Synced passkeys fixed most of it.
For shared warehouse PCs, a passkey on the device is effectively a shared credential. Either hand those users hardware keys or keep password + TOTP on their phones. Do not let the edge case block everyone else, but plan for it.
TOTP stops stuffing but not phishing. Adversary-in-the-middle kits relay the six-digit code in real time; we see them in the wild every month. Passkeys are bound to the origin, so a fake login page simply gets nothing.
Roll out passkeys first, keep TOTP as the fallback, and make SSO the answer for the 30% who have an IdP.
The enrolment UX matters more than the protocol. Prompt right after a successful login, not on a settings page nobody visits.