>It stretches the definition of "two-factor" I always considered the time aspect to be the more important "factor" of TOTP in practice. E.g., if somebody manag

>It stretches the definition of "two-factor" I always considered the time aspect to be the more important "factor" of TOTP in practice. E.g., if somebody managed to peek over your shoulder or film you while typing in your password. With TOTP, they have under a minute to capitalize on that information. I still have that base covered with my password manager handling the secret key, so I never saw the appeal of tying TOTP to a phone.