> 1. Intentionally presenting things that are complicated as inherently suspicious. (Delivering security by design can be complicated, yes!)
This is a matter of opinion. Personally I think making a technology understandable is more important than incomprehensible but secure.
> 2. Describing TOTP as a “great solution” for adding security to a password-based account. When the most common threat model on the web is phishing (a word the post never mentions!), TOTP hardly buys you _anything_. TOTP is phishable.
Phishing isn’t a big threat to regular consumers. It’s a bigger threat to workers at corporations and government agencies. These places have IT departments. They have better solutions than passkeys, including using a Yubikey as a second factor. It may be based on WebAuthn but it’s not a passkey.
> 3. Seeming to be unbothered by how many logical leaps are being taken without actually understanding the topic being discussed.
Why are the logical leaps? I don’t see any. What I see is clearly delineated hypotheses for future scenarios. We can’t predict the future but the original author is predicting a particularly dire future, whereas rmondello is predicting a better future.