> We are, by definition down to single factor if you store the codes in the password vault. Agreed, I should have worded that differently, that was just asking

> We are, by definition down to single factor if you store the codes in the password vault. Agreed, I should have worded that differently, that was just asking for someone to nitpick. But I don't think that detracts from my wider point. > One example would be that you leave your desk momentarily with your password vault unlocked and someone decides to quickly use your account to login to some system. TFA is talking about personal security, which I read as "private life security", not "workplace security for a software engineer on their work laptop in a semi-public space". That would be a much more high-value target with a very different threat landscape that warrants more effort to be spent on security (supported by security teams, on paid time, and having above-average security expertise).