Comment

Comment by felixfoertsch

To me, this totally depends on your threat model.

Generally, a one-time password is an additional security measure that prevents someone from going to a website and simply using obtained credentials (eg from a leak) or brute-forcing them. An attacker needs the second factor.

If you store your 2FA secret alongside your password in a password manager, you still gain protection from these attacks. And it's very convenient. However, you also increase your attack surface: if they break into your password manager, your done.

If your threat model allows it (mine does), this is still very secure and also very convenient.

Discussion

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton