By that logic the password itself is two-factor, because you need the database password as well as the database file to obtain the target password. I definitely

By that logic the password itself is two-factor, because you need the database password as well as the database file to obtain the target password. I definitely see where you're coming from, but I'm not sure why you'd still bother setting up 2FA with backup codes then if you already consider the password itself 2FA? A higher security level, which isn't needed for everyone indeed, would be to have these two things (where you have your password database unlocked, usually multiple times a day, and the second factor secret codes) in independent locations. This can also be two VMs if you keep the host encrypted and very secure for example. I assumed people with 2FA wanted to achieve a bit higher security level than all eggs in one basket. (None of these things beat a wrench attack of course.)