> When someone stores their MFA credential in a password manager, that only means that in the worst case, they are as insecure as someone with no MFA – right?

> When someone stores their MFA credential in a password manager, that only means that in the worst case, they are as insecure as someone with no MFA – right? Even if this was right (which I don't think it is under the threat model described by the OP: they claim, rightpy or wrongly, that the attack surface somehow increases when everybody adopts MFA), consider the protocol where you have to enter your password and cut off a lock of hair to authenticate. In the worst case, this is as insecure as someone who just enters their password without any hair cutting, but doesn't mean that adopting it would not be a big problem, or even a good thing overall (at the very least it would massively inconvenience bald people; there are parallels, it's not like MFA does not inconvenience certain people).