Arguably storing TOTP tokens in your password manager does provide a level of protection against phishing. You might fool me with that phishing page, but you w

Arguably storing TOTP tokens in your password manager does provide a level of protection against phishing. You might fool me with that phishing page, but you won't fool my password manager's autofill. It would have to be full on MITM or DNS poisoning for that to work, which is already more of a movie plot.