> That's not to say it's useless, at the very least it's another layer that attackers have to figure out. But the true benefits of 2FA come from needing multiple devices to access accounts. If all of the factors are stored in one program on one device, then in the situation where that device/program is cracked, the attackers have everything.

I feel you're not portraying the trade-off accurately so I'll try to clarify.

It's not merely better because it's just "another layer to figure out". That's what you would get with 2 passwords. It's not what you get with 1 password + 1 OTP.

With OTP you're protected against your password being logged and used later on e.g. an untrusted or breached machine (say, at a library). I'd hazard to guess that dealing with a passive adversary who's time-separated from you is FAR more common/likely than having your actual password database stolen or cracked somehow. Meaning it's still quite a significant benefit to having OTP.

What's a good secondary service to store the TOTP codes separate from passcodes?

Authy, from what I understand, requires a phone number as backup, meaning it could be compromised by the same method

Google authenticator can't be backedup, which is royally annoying when you change/lose devices

Lastpass has some security issues, and one well known comment here has recommended no one use it.

I heard someone say they use Duo security: does that let you store codes? When I looked it just seemed to lock various services

Personally I use Google Authenticator. The lack of a backup is a feature not a con IMO.

Every account I have setup with TOTP I also make sure to print out the recovery codes and put them in a safe, and use them if my device is ever destroyed. When I switch phones (which for me happens maybe once every 2-3 years at most), I go through the shitty process of transferring the TOTP codes over to the new device, but it doesn't really take all that long (it took me an hour to do it for about a dozen accounts last time I did it), and I'd much rather not have any of it uploaded anywhere.

You can print out the QR code or save that somehow during setup and use that to setup TOTP codes on other devices (or the same TOTP on multiple devices), but I tend not to do that as recovery codes work just as well, and they notify you if they are used (unlike a TOTP setup QR code). I did have to store the QR code for one account that doesn't provide recovery codes, but it's overall not that much extra work.

Google Authenticator does not help prevent against a compromised device (as all TOTP secrets and seeds are on device) and is truly a pain when working with multiple phones. Personally I use Yubico Authenticator as all the TOTPs live on my Yubikey. That, in combination with a password then clicking on a totp i want and tapping my yubikey provides me with only that code. When I first seed the yubikey with a new TOTP i also backup a copy of the QR code text and save it into my password manager in the unfortunate event of having to swap out yubikeys.

Doesn't this mean your password manager is still single factor? Access that, access everything. That's the problem I was trying to avoid.

I use pass for my password manager which links to my yubikey that has my gpg key on it. My yubikey has touch enabled which means that even if someone got access to my machine with my yubikey on it and asked me to tap they would only get that single password. As far as TOTP is concerned it's the same thing. The TOTP section of my yubikey has it's password and also requires a tap

This is good advice. I also have my TOTP set up on at least two devices, my phone, my previous phone, and my iPad. (Both phones because it's fairly common for me to have both my current phone and my iPad with me at the same time. It's spectacularly rare for me to have all three devices with me outside my home.)

You can use Authenticator Plus, which cloud syncs your 2FA DB on every add/delete/update you make to any of your 2FA accounts.

I use Authenticator Plus (https://play.google.com/store/apps/details?id=com.mufri.auth...) which has encrypted cloud backup (Google Drive or Dropbox). The encryption is done client-side. When I get a new phone, all I do is set up A+'s cloud sync on the new phone, enter the passphrase I've used previously, and it syncs all my TOTP codes.

As a bonus, the backup is just an encrypted sqlite DB (with dirt-simple schema), so you're not tied to some inscrutable proprietary format, and can easily extract the tokens if you want to use a different app/service.

Authy let you password encrypt your data with then, so even if someone ports your sim it won't give them access.

When setting up a new TOTP for Google Authenticator for my personal accounts, my standard procedure is to take a screenshot of the initialization QR code, and encrypt that screenshot with my gpg key. That is then stored on my external backup disk (which incidentally uses FDE via luks).

I use a Yubikey + my phone for storing copies of TOTP codes

Means I don't have to worry about phone upgrades and such, and if the Yubikey were to stop working I still have it on my phone

You can back up the Key used to set up the TOTP system. This allows you to re-seed the TOTP generator on a new device without needing to go through setup.

You can disable "multi device" mode in Authy, this prevents adding new devices via SMS auth.

Even when you authenticate via SMS in multi device mode, the imported tokens still have to be decrypted via a master password. SMS is just your account identifier on Authy, hijacking it will not allow access to your tokens on its own.

Simple solution, have a secondary db for totp.

I have this in case my yubikey ever dies and takes my totp codes with it.