I’d add another risk here because I think it’s the main one the TOTP actually ends up protecting against in this case: Credential Stuffing.
Since the TOTP secret is generated by the service and not the user, it prevents credential stuffing. It can’t be reused between sites. If you’re still reusing the same password on every site this is a huge increase in security given how many services are breached.
… but using a password manager and a unique password for each service already does that.
So storing your TOTP secrets alongside your password in your password manager is a _very_ marginal benefit. Prevents a replay of the login if it got captured in the clear and… not much else I can think of.
Where-as a “true” 2FA adds protection against malware, data breaches, physical access, and other risks. That seems like a pretty big benefit for minimal work.
I think for most people using TOTP to avoid the “this shady download/keylogger controls my entire life now” scenario is a pretty clear win on effort versus risk.
So I mostly agree with what you wrote here except the summary. I’d say everyone should be using “true” TOTP where they can, and if you’re going to store them alongside your password they’re little more than security theatre so don’t bother.
Since the TOTP secret is generated by the service and not the user, it prevents credential stuffing. It can’t be reused between sites. If you’re still reusing the same password on every site this is a huge increase in security given how many services are breached.
… but using a password manager and a unique password for each service already does that.
So storing your TOTP secrets alongside your password in your password manager is a _very_ marginal benefit. Prevents a replay of the login if it got captured in the clear and… not much else I can think of.
Where-as a “true” 2FA adds protection against malware, data breaches, physical access, and other risks. That seems like a pretty big benefit for minimal work.
I think for most people using TOTP to avoid the “this shady download/keylogger controls my entire life now” scenario is a pretty clear win on effort versus risk.
So I mostly agree with what you wrote here except the summary. I’d say everyone should be using “true” TOTP where they can, and if you’re going to store them alongside your password they’re little more than security theatre so don’t bother.