TOTP can be phished remotely, passkeys / hardware security keys can’t (need to get malware into the users’ computer instead)