@nowster @psf@oldbytes.space I think the main counter is that a bunch of companies doing 2FA without asymmetric crypto are using a third party vendor for the 2FA part, and in that case the TOTP secrets are in a separate security domain to the passwords