[tajen]

> Combined with a password manager is a pretty good combination.

So 2FA combines something you have (your phone) with something your phone knows.

[rahkiin]

Exactly! And I use 1Password so I also have the tokens on my computer, together with my passwords. Replay attacks get harder though.

[justinlardinois]

I think his point was that if your password is stored on your phone, two factor authentication doesn't actually add any security because it's no longer two factor.

[crpatino]

not if you access the site from a laptop/desktop