As I understand things, given a user with proper password management (e.g. with a libre password manager like KeePassXC) the only realistic threat is having passwords leaked the following ways:
A: password keylogged (e.g. logging in to your account on any compromised device) or phished
B: manager database leaked (e.g. unlocked on your compromised device)
OTP as single-factor authentication is enough to protect against A if not attacked before token expiry (but perhaps that is not a realistic assumption after reading the answer of @CBHacking). In this regard, OTP is superior to passwords (even if not as much as I previously thought), and I cannot think of any way they would be inferior. Thus, OTP seems strictly superior to passwords.
2FA mitigates the risk of B, but it seems excessive for marginal benefit: it is relevant if and only if the first factor is compromised while the second one is not. While this might not be an uncommon situation today, I think it would be uncommon in the case where OTP replaces passwords and even more uncommon with the premise of a user with proper password management for the following two reasons:
- OTP is less likely than passwords to be stored on a compromised device (PC).
- A user who uses a password manager is more likely to store both factors on the same device (I myself have my TOTP and passwords in the same KeePassXC database).
Even if I am wrong about 2FA being excessive, and especially if the user is not good at password management, it seems superior to have [OTP + OTP] rather than [password + OTP] as 2FA.
Is it a bad idea to offer users to replace passwords with OTP?
Is it a bad idea to force users to replace passwords with OTP?
If passwords are not used, does 2FA (double-OTP instead of single-OTP) offer substantial benefit?
P.S. While writing this I came up with one reason [password + OTP] might be superior to [OTP + OTP]. In the former case it is less likely that both factors are stored on the same device.