An attacker compromising your desktop would ordinarily -also- need to compromise a second device like a Yubikey or a phone. Regularly exposing 2FA secrets in p

An attacker compromising your desktop would ordinarily -also- need to compromise a second device like a Yubikey or a phone. Regularly exposing 2FA secrets in plan text to the system memory of your (potentially compromised) endpoint defeats a lot of the point of 2FA. If an attacker can access the secret they can generate unlimited codes. Even if all they can do is change the system clock they can get codes valid in the future. I really wish dangerous advice like this would stop getting upvoted. Also, TOTP is phishable, so never use it if more secure methods like FIDO2 are supported on a service.