Passkeys vs passwords + TOTP for a B2B SaaS login
Last month we had a credential-stuffing incident: 140 accounts accessed with passwords leaked from another site. Password-only login has to go. Option A is passkeys first: offer passkeys at sign-in, nudge everyone to enrol, keep passwords as a fallback for a while. Option B is…