@fbinin @hrafnagud @panda @homelab Furthermore I like to manage my credentials and MFA settings in one place instead of in multiple applications. My services a home grew to the point I already have 14 applications using Keycloak as OTP service. Additionally a Single Sign On requires less support for family members. (I'm aware not every one wants to operate so many applications)

@fbinin @hrafnagud @panda @homelab But a good TOTP implementation takes some effort too if you want to support multiple devices and recovery codes. The library updates are probably not because of TOTP itself, the might be required due to the libraries dependencies or framework integrations. Furthermore, if TOTP is implemented, why not add WebAuthn/Passkeys too?

@panda @hrafnagud @homelab I want state-of-the-art security for all users, but I also understand developers' positions. I initially implemented multiple login methods in my applications by using existing libraries, but this got too hard to keep up to date, especially when I tried to integrate WebAuthn/Passkeys. Therefore, I started using OAUTH and delegated the hard part of different login methods.
My proposal is to make security easy by referring to simple, and easy-to-set-up OAUTH services.