The idea of 2 factor authentication is that if you can prove that you have both a password and a device, you are trusted to be who you say you are. My question is, why does the service still ask you for the password, instead of just asking you to prove that you have it?
In particular, since we have a device, it could just use a 2 server password-authenticated key retrieval instead. In a three-way communication between the service, the device, and the user (well, actually their browser or a USB dongle if they prefer), the user proves that they have the password. That way, an adversary needs to compromise both the service and the device to get a chance at even brute-forcing the password, and if the service or device are just super insecure (i.e. not generating random numbers properly or something), you are still protected if the other one is secure.
Should I distrust 2fa services that ask for the password as possibly using poor security practices (i.e. should I not use them to store sensitive data), or is there some valid reason for them to ask for a password?