Nowadays, many Password managers offer options for 2-Factor Authentication such as TOTP. I am really confused regarding this. Isn't the whole point of 2FA is to prove you have a second way of proving your identity?
What kind of security risks would I have if I have both my passwords and 2FA within the same app compared to having them in different separate apps? Does having them within a single app pose any significant risk?
What kind of security risks would I have if I have both my passwords and 2FA within the same app?
What is your threat scenario?
It's convenient. On my laptop, both are available without any external devices. If I log on a website on a computer I don't own, I look up the password and OTP on my phone. The attacker in this scenario will get password, but not secret for 2FA - thus it thwarts many attacks in case of key loggers.
It also thwarts password leaks. If my password is leaked from another site, due to password re-use, 2FA will thwart attackers.
It obviously provides less security than a physical token, as malware on my computer may access the secret - something which is impossible with for instance a Yubikey.
Like so many other security features it's a trade-off between usability and security. It's better security, especially in some scenarios, than no 2FA, and it's weaker than a proper hardware token. It's more convenient than a hardware token, but less secure. It's cheaper than a hardware token, but also less secure...
I use both. For some sites, that would be inconvenient but not fatal to loose access to I use Bitwarden. For others, I carry a Yubikey. So in short - carry out a threat assessment. Who are you protecting against, and what attacks can they mount against you? There's no universal answer; it's a trade-off you have to make for your use case.
