> why do you trust your phone to have a session token for your Google account, but not the TOTP secret? Why would you trust Google or anyone else with your wor

> why do you trust your phone to have a session token for your Google account, but not the TOTP secret? Why would you trust Google or anyone else with your work (bank, Github, whatever you use TOTP for) credentials? I can't understand how anyone would think it's "pseudo-security". As you rightly say, your credentials are in plain text on that phone.