>if ... the Password Manager gets compromised, the attacker will get their hands not only on your passwords, but also the secrets used to generate the TOTP HMAC

>if ... the Password Manager gets compromised, the attacker will get their hands not only on your passwords, but also the secrets used to generate the TOTP HMACs. As true as this is, it's because TOTP often breaks the spirit of MFA. Password-only logins where a password manager does the form filling are frictionless. Adding TOTP MFA to every single login—even a login from a known browser, where an existing cookie and browser fingerprint would serve adequately as the second factor—regresses UX back to the point before password managers got involved. Back when I was typing passwords, I didn't have to pull out my phone and look them up first. The TOTP seed has just become the real password, because your "password" password isn't good enough. Security is hard, so service providers assume you're going to screw it up, and they make authentication suck.