Comment by acdha

I’ve been migrating away from TOTP since it’s so easily phished but my current approach is to use Yubikeys with their app:

https://www.yubico.com/products/yubico-authenticator/

That avoids keeping the seeds somewhere a general attack could get (and requiring a tap complicates attacks) and works across all of my devices. The main drawback is that there isn’t an easy way to install a seed on multiple keys when first enrolling.