I'm building a Progressive Web App intended to be used primarily in an offline state. The user can "login" while disconnected, which verifies the password against a locally-stored hash and some other stuff.
The idea has been proposed to add 2FA to the offline login to make it "more secure". However, my (limited) understanding of MFA tells me that I'd have to store the 2FA secret key locally, and this code could be retrieved and probably be used to reverse engineer the auth code, making the whole thing moot.
(For the sake of argument, let's pretend this isn't JavaScript and a malicious actor can't just "skip" past my login process to access the app offline without logging in.)
Am I correct in my assumption that this is a dead-end? Or is there a way to do 2FA purely offline in a secure manner? Is there a better way to approach this?