Go ahead and use your password vault for your TOTP. And again, secret splitting has NOTHING to do with the threat mitigation that 2FA offers.

If you want to split the TOTP secrets out of your password manager, you should store them on a completely separate physical device. If an attacker breaks into your phone, all of the apps on your phone will be compromised. If an attacker has broken into your safe, they will get both halves of the secret. This is like someone splitting a secret into two envelopes and then putting them next to each other in the same safe. The problem is some people choose to use a second app on their phone instead. To wit, if you don't trust your password manager to store all of your secrets, you can keep part of the authentication secrets out of the password manager. Secret splitting addresses a different concern, which is where you don't trust a single system of record.

That is, if someone overhears your password, they don't have enough to impersonate you. False! You are talking about the virtues of secret splitting.ĢFA ensures that your account is protected against replay attacks.

Totp bitwarden