6
Security
Passkeys vs passwords + TOTP for a B2B SaaS login
Security ↔ Support load
Context
Replace password-only login after a credential-stuffing incident.
Last month we had a credential-stuffing incident: 140 accounts accessed with passwords leaked from another site. Password-only login has to go.
Option A is passkeys first: offer passkeys at sign-in, nudge everyone to enrol, keep passwords as a fallback for a while.
Option B is the familiar passwords + TOTP authenticator apps, which every customer's IT team already understands.
Complication: some customers run warehouses where several people share one Windows PC.
Constraints
- Users
- 45K across 900 companies
- SSO
- 30% of customers
- Devices
- Shared warehouse PCs
Passkeys firstvsPasswords + TOTP
Community verdict
Passkeys first 63%Passwords + TOTP 37%
8 engineers · 4 opinions
With these constraints, what would you choose?
One choice per engineer. You can change it any time.
Passkeys first
Passwords + TOTP
Familiarity →
Trade-offs
Dimensions
Passkeys firstPasswords + TOTPout of 5
- Phishing resistance
- 5Passkeys first scores 5 of 52Passwords + TOTP scores 2 of 5
- Familiarity
- 2Passkeys first scores 2 of 55Passwords + TOTP scores 5 of 5
- Shared devices
- 2
Community discussion
4 comments
Have you made this decision in production? Share your reasoning.
Sign in to commentTOTP stops stuffing but not phishing. Adversary-in-the-middle kits relay the six-digit code in real time; we see them in the wild every month. Passkeys are bound to the origin, so a fake login page simply gets nothing.
Roll out passkeys first, keep TOTP as the fallback, and make SSO the answer for the 30% who have an IdP.
The enrolment UX matters more than the protocol. Prompt right after a successful login, not on a settings page nobody visits.
Account recovery is where both options fail if you don't design it. Our support tickets after launching passkeys were 90% "new phone, can't log in". Synced passkeys fixed most of it.
For shared warehouse PCs, a passkey on the device is effectively a shared credential. Either hand those users hardware keys or keep password + TOTP on their phones. Do not let the edge case block everyone else, but plan for it.