> When done poorly (and most are), TOTP is basically no additional factor TOTP protects against the most common threats, and is trivial to implement compared t

> When done poorly (and most are), TOTP is basically no additional factor TOTP protects against the most common threats, and is trivial to implement compared to other solutions you refer to. Most of your complaints about TOTP security don't make sense under its threat model. Yes, if your phone is rooted, the TOTP secrets can be stolen. The point is that it's unlikely that both your phone and your laptop/point of access device both get compromised.