"that's in theory a "something you know", but if I don't know it, then who does" An attacker. Your knowledge is much less interesting that the knowledge the se

"that's in theory a "something you know", but if I don't know it, then who does" An attacker. Your knowledge is much less interesting that the knowledge the server has, which is what the attacker can obtain. Grabbing a TOTP key out of a database is not materially different than a password. TOTP's different characteristics mean it's harder to intercept, but passwords tend to be stolen nowadays moreso than intercepted, if only because you can intercept only one at a time but can steal the entire database. The different characteristics mean it can add a bit of utility to a normal password, but I think it's less night-and-day than it was presented as.