Passkeys, TOTP (Time-based One-Time Password), two-factor authentication (2FA), hardware security keys, password managers — yeah, it can be a lot. This article is here to help you not feel overwhelmed by it all. Let’s look at how these tools actually work, what their limitations are, and what you should realistically expect from them.

Passkeys are designed to replace passwords with cryptographic keys. The common refrain is that the private key “never leaves your device.” That’s mostly true if you are using a single device. But if you use multiple devices and want your passkeys available on each device, passkeys typically sync between your trusted devices via encrypted cloud storage.

This means your private key does travel — just encrypted and only accessible on devices you have authenticated. If you want to use passkeys on a device outside your usual ecosystem, you often need to transfer them manually (e.g., scanning a QR code) or use a hardware security key. So, the “never leaves your device” slogan is a bit of a simplification.

Could Passkeys Be Intercepted During Sync or Transfer?

Wireless protocols like Bluetooth or Handoff features can make syncing and continuity a breeze, but they use strong encryption. Intercepting passkeys during these transfers would require breaking that encryption or exploiting a vulnerability in the device’s security model. While nothing is impossible, such attacks are highly impractical and not a common threat vector.

TOTP (time‑based one‑time password) is a widely used 2FA method in which the server and the user’s authenticator app share a secret key. That secret is used to generate short-lived codes that prove possession of the key within a brief window of time (often 30-seconds or less).

A point of security concern is who controls the secret during provisioning: if an attacker is able to cause a user to provision an authenticator with an attacker-controlled secret (for example by injecting a malicious QR code or provisioning URI onto a page the user trusts), the attacker already knows the valid codes and can bypass TOTP-based 2FA. Likewise, if the server or the user’s device is compromised, the secret can be stolen and codes forged. Therefore secure provisioning (binding the secret to an authenticated session and origin, validating provisioning URIs, and preventing injection of attacker-controlled QR/URIs) is as important as protecting stored secrets on server and device.

How a malicious provisioning attack works

1. Attacker prepares an otpauth://totp/…?secret=ATTACKER_SECRET provisioning URI and renders it as a QR code.

2. Attacker gets that QR code displayed to the victim — e.g., by injecting it into an otherwise legitimate web page (third‑party script compromise, XSS, or a hidden iframe supplied by attacker content).

3. Victim scans the QR code with their authenticator app. The app stores ATTACKER_SECRET tied to the victim’s account label.

4. Victim completes provisioning and starts using generated codes — but those codes are the same codes the attacker can compute from ATTACKER_SECRET.

5. Attacker uses the shared secret to generate valid TOTP codes and bypasses 2FA.

This differs from “server compromise”: here the attacker doesn’t need to break the account’s server — they only need to trick the user into linking to the attacker’s secret during setup. Yes it's complicated but not improbable (and a browser search for the terms "server compromise totp cve" can give you more technical details on that aspect if you're interested).

Hardware security keys (like YubiKey, Titan Key, and the FIDO2 protocol) provide a physical second factor that’s extremely difficult to compromise remotely. They use public key cryptography and connect via USB, NFC, or Bluetooth.

Because the private key never leaves the hardware device and authentication requires physical presence, these keys are considered to be the strongest defenses against unauthorized account access.

Password managers store and autofill your passwords, often syncing them across devices. They reduce the risk of password reuse and help generate strong, unique passwords, while often including a TOTP option.

However, their security depends on how well they protect your master password and encryption keys. Using a password manager on the same device as your authenticator app or other 2FA methods can be a weak point if that device is compromised.

• Passkeys improve security by eliminating passwords but rely on encrypted syncing or hardware keys for multi-device use.

• TOTP adds a layer of protection but depends on the secrecy of shared keys on both your device and the server.

• Hardware security keys offer the strongest protection for 2FA by requiring physical presence and keeping private keys isolated.

• Password managers are essential for good password hygiene but are only as secure as the device and master password protecting them.

No security measure is perfect, but layering these tools thoughtfully can make unauthorized access significantly harder. Understanding their strengths and limitations helps you make smarter choices about how you secure your digital activities.