> smattering of pseudo-security That's a good description of the state of my knowledge. To answer your question: the Google account that my phone has access t

> smattering of pseudo-security That's a good description of the state of my knowledge. To answer your question: the Google account that my phone has access to doesn't have anything important, so I'm not worried about any related keys leaking. The TOTP secret would be for something more important, that the phone itself doesn't have access to. In other words, I'm wondering whether a generic Android phone is safe to use as an over-sized hardware security token (or rather, as backup for a more convenient hardware token). It seems the answer is no.