Technology

It is a security threat, and to claim it doesn’t count is absurd.

Oh, absolutely.

Replay attack is the wrong term, here's the threat model I'm talking about. Basically, the attacker watches the authentication flow and uses the resulting session (token?) to make web requests as you, stealing whatever data it wants. There's no attack on the authentication scheme, but on the shortcuts web services use.

It doesn't matter if you use passwords, TOTP, or webauthn, there's going to be some vector to attack the system without breaking the authentication mechanism.

The average user isn't going to see much security benefit from webauthn vs TOTP in the same way that adding a better lock to your front door is unlikely to improve your overall home security, because at a certain point, the burglar will just smash a window. TOTP is good enough because it's safe from attacks on email and SMS that worse one-time code systems use. You should definitely have a lock on your door, but at a certain point, the lock is no longer the weak point in the system.

And yes, I'm using "code generation" as a generic catchall. I group auth systems like so:

• offline threats - e.g. passwords that can be broken by seeing the hash
• reliant on third party service that can be attacked separately - email and SMS
• "code generation" - uses some cryptographic mechanism to generate some unfakable code that can't be reused; seeing more examples doesn't help, and codes can't be reused

If your password manager handles the second factor, the user experience of TOTP vs webauthn is nearly identical, and the security is nearly identical to your average attacker, to the point where they won't attack the authentication mechanism itself, but something else on the website or the password manager itself.

The problem is that most people do only use plain old passwords. If we can get any kind of extra security, even TOTP, then all the better.

Exactly. The difference between TOTP and webauthn only really matters if you're a government or something else where state-level actors are part of your threat model. If your service uses one or the other, the distinction isn't important to the average user.