I don't think it's as bad an idea as you assume. Think about what threats you're trying to guard against by using TOTP, and think about what attack scenarios are made easier (or not) if storing the TOTP seed in your password safe.
With the seed in your password database, TOTP will still guard against:
- Password breaches of the website where you hold your account
- Keyloggers on untrusted computers (on which I assume you will not actually run your password manager, but rather read a password off a trusted device and type it in manually)
- Network captures on open WiFi networks, etc.
- Phishing/social engineering of you, the user
Things which are NOT guarded against include:
- Social engineering of customer service/tech support of the website owner
- A stolen password database and master password
The first case cannot be helped regardless of where your TOTP seed is stored. The second case deserves some additional consideration. Specifically, how can your database and master password be breached? Either:
- The attacker obtains a copy of your database from cloud storage, or a discarded backup, and cracks your master password. A strong master password (80+ bits of entropy) and secure implementation of a KDF on the part of the password manager developers should completely prevent this attack.
- The attacker puts malware on your machine which is specifically designed to target your password manager. But consider: if you have such targeted malware on your machine, why not write malware to hijack a browser session? Or force-install a browser extension to steal all the desired information? Or install a custom certificate to allow a MITM attack? A browser extension could even display pages making it look like you were simply logging into the site again, whereas in reality you were providing the credentials needed to disable 2FA entirely!
Now, some caveats: there is ready-made malware (or at least proof-of-concept code) out there which can already target specific password managers. I'm not aware of any ready-made malware that interactively takes over an account to disable 2FA.
But the point is, the only scenario where the TOTP seed causes problems for you, is a scenario that would also cause problems even if your TOTP seed was stored elsewhere. With that in mind, I've not seen any convincing arguments against keeping the TOTP code in my password manager, especially for password managers that can use the TOTP seed to generate the codes for you in place of Authenticator, Authy, etc.
Recent events have brought to my attention a scenario I did not consider above: if you store an account in your password manager, which you only ever access on specific systems, you can expose yourself to increased risk by storing the 2FA code for that specific account in your normal, synced-everywhere, day-to-day password vault.
Specifically, I'm referring to the continued fallout from the late 2022 LastPass breach. It came to light recently that a senior DevOps engineer at LastPass had their personal password manager data stolen from their home computer. From there, the attackers extracted login credentials for a corporate vault that only 3 other employees had access to: https://arstechnica.com/information-technology/2023/02/lastpass-hackers-infected-employees-home-computer-and-stole-corporate-vault/
Now, the article does not specify whether the corporate vault was protected with any sort of 2FA, or if seed values for TOTP-based 2FA for this vault were stored in the engineer's personal password manager. It also doesn't specify whether the engineer ever used this corporate vault from their home computer (but that seems unlikely). The level of sophistication and persistence these attackers showed, and the high value of this engineer's account, imply that this person may have been compromised eventually even if they did have 2FA codes stored only on their phone. HOWEVER, the event raises the following plausible scenario in my mind:
- You have a sensitive account which you access only at work (or similar). You do not (or maybe cannot) access this account at home.
- You sync your password manager between home and work.
- You store your work-only account password and 2FA key together in your personal password manager.
- An attacker completely pwns your home computer, while you access your personal vault at home.
In this very specific scenario, your work-only account is indeed at increased risk of exposure. Presumably, corporate assets are protected better than your home computer and are less likely to have vulnerable media player software and the like installed so their attack surface is reduced.
If you have accounts you only ever access from specific devices, storing both the password and 2FA seed together in a vault accessed from multiple other devices does probably degrade the security of that specific account.
HOWEVER: as before, storing the 2FA code in an encrypted vault on the same device you use to login doesn't really add risk. Looking at how this engineer's personal vault was compromised, 2FA did not help at all. It didn't matter if they had stored their 2FA seed in their vault, or on their phone. The attacker was running malware locally on the computer the engineer was logged into, and was able to bypass MFA simply by waiting for the engineer to enter the MFA code themself.
I assume that most people generally do not have high-value accounts only accessible from specific devices, where they login using their vault shared with other devices. If you are one of the high-value targets holding keys to a high-value asset, it is probably wise not to store password and 2FA seeds together on some other less secure device. If this very specific scenario does not describe you and the account you are protecting (I assume this is the case for most people), then refer to the previous analysis.
