Or you could use a Yubikey to store the secrets, and https://github.com/Yubico/yubioath-desktop https://github.com/Yubico/yubioath-desktop on your desktop. That

Or you could use a Yubikey to store the secrets, and https://github.com/Yubico/yubioath-desktop https://github.com/Yubico/yubioath-desktop on your desktop. That way you would still have a portable second factor, and it would be very very hard to extract the secrets.