I think you misunderstand my point. It has nothing to do with the ongoing debate about whether or not passwords are good or bad and should be superseded by some

I think you misunderstand my point. It has nothing to do with the ongoing debate about whether or not passwords are good or bad and should be superseded by some other approach. It has to do with whether or not it's a second factor. To remind people, though I alluded to it in my post, the factors are: A thing you know, a thing you are, a thing you have. A second factor must not merely be an additional thing in the same category, it must be in a separate category. (Otherwise we could increase security simply by requiring that the user input six passwords instead of just one.) My objection is that TOTP is still fundamentally a thing you know. The fact that my "thing I know" store (more typically called a "password manager") can store them is strong evidence, if not proof, of this fact. Your argument in a way further reinforces that point. If they're better passwords than passwords, hey, by all mean make users log in through a TOTP token and skip the password entirely. But that's exactly the problem! It is sufficiently passwordlike for this to be a valid possibility. The rest of the frippery around TOTP that tries to turn it into a "thing you have" are all on the client side, and thus, security theater. Google Authenticate making it a pain to get my secrets out wasn't actually security (and they had to let it out anyhow because when people upgrade phones they don't want to have to rotate dozens of tokens). It was a "thing I know" every bit as much as my password to my bank is a "thing I know", despite the fact I don't actually "know" it in the sense that it is in my memory. I have no idea what my bank password is. But the things stored in my password manager and the things I can store in my password manager are all "things I know". I can't store a thing I am [1] or a thing I have in my password manager. Being able to store them in my thing-I-know manager shatters the illusion that this is about a thing-I-have. Push notifications to specific phones aren't perfect but they are a lot closer to a "thing I have". [1]: I mean, in principle. Certainly I can store the things that I am in my password manager. However if my password manager could present my fingerprint directly that would generally be considered some sort of security violation. That said, I'm not a big fan of "thing I am" in general precisely because while it may work when everyone's honest, who cares about the characteristics of a security system when that's the case? In case of active attack, "thing I am" degenerates to "thing I know" because it will always be possible to fake it if I know it, generally quite practically for any feasible consumer solution. Only super high security installations can justify the degree of expensive hardware necessary to do good checks of "thing I am". And if it degenerates to "thing I know", it further degenerates to "thing I know that I also can never change", which means that biometrics are actually much worse for security than the traditional "thing I know" until possibly quite high on the expense curve for the biometrics hardware and invasiveness.