zlacker

In this case there is also a perceivable benefit for the user. SMS 2FA is vulnerable to sim swapping, this is not possible when TOTPs are delivered in-app. The app is also FOSS [1], so even if you're paranoid you can still inspect what data is sent.

There are also just some things you cannot realistically do in the browser (or over SMS) without having to ship specialised hardware to 18 million people, like reading the NFC chip of your passport. This is needed for DigiD Substantieel and Hoog, which are mandated by the eIDAS regulations.

[1] https://github.com/MinBZK/woo-besluit-broncode-digid-app/

>>bramha+(OP)
TOTP is able to be intercepted on the device.

>>esseph+k2
Yes, and that's also true for SMS messages and your passwords. That is why having MFA is important.

>>bramha+g3
You can't intercept a passkey in the same way.

It is also far less likely to be phished, and there is nothing transmitted.

TOTP is the modern WPA2 of security - it's just not good enough when better alternatives exist.

>>esseph+B8
What kind of risk profile does one have when it is likely that both the password is known and malware has been installed on the phone, but also just access to an ephemeral login session by the attacker (which could be obtained even when using a secure enclave by waiting for the user to authenticate by themselves) would not be enough?

>>lieuwe+NT
> password is known

What password?