1. using password managers for TOTP defeats the purpose of TOTP as a second factor 2. using password managers for TOTP is useful Both can be true simultaneous

1. using password managers for TOTP defeats the purpose of TOTP as a second factor 2. using password managers for TOTP is useful Both can be true simultaneously. The point of "something you have" is that it is "literally infeasible" to compromise your account without physically robbing you of your yubikey-equivalent. That automatically excludes >99% of the population that aren't within X miles of you from being able to potentially attack you. Using this definition, both SMS and TOTP already fail, but at least one can approximate it by storing the TOTP on a physical device in a way that blocks casual export. If you store it in a (non-local/backed up) password manager, you completely give up the pretense that "it is impossible to compromise your account without physically robbing you of your yubikey-equivalent". Someone from across the world can now compromise you without leaving their room. Now again, just because it doesn't meet the "2FA threshold", doesn't make it useless. But it is also true that it doesn't provide the level of security that 2FA is supposed to provide.