I really disagree with this idea. It reminds me of how developers try to prevent you from pasting passwords into password fields. The benefit of using TOTP at

I really disagree with this idea. It reminds me of how developers try to prevent you from pasting passwords into password fields. The benefit of using TOTP at all far outweighs the insecurity of storing it on the same computer. And it is so low effort, I use it everywhere possible. I have a simple script that takes a screenshot, uses zbarimg to extract the single line otpauth:// string, and appends it to my pass password database[1], which then hooks back into my browser. I somehow don't think I would bother with a hardware key for my BestBuy.com account. Besides, my password db is itself is encrypted with GPG, and GPG can use a hardware token to be unlocked, thereby giving you more flexibility and transparency, while still benefiting from a token. Developers can't know what configuration users have. [1]: https://www.passwordstore.org/ https://www.passwordstore.org/