Are you managing your OTP manually or automatically?

01 Tem 08:27

Personally, I clearly lean towards the **TOTP** (Time-based One-Time Password) option via a password manager like Bitwarden or KeePass—it's clearly my favorite for personal use. Why? Because it's an ideal balance between security and convenience: the codes are generated locally (no network dependency like SMS), suitable for critical accounts (GitHub, AWS, etc.), and manageable from a single trusted source. The only real downside is backing up the seed (secret key)—you need to export and store it offline, or you could get locked out if your device fails. For cases where TOTP isn't supported (banks, some admin services), I often fall back to **email OTP**—less secure than other methods but better than nothing. Hardware tokens (like YubiKey) are top-tier in security, but the cost and management of physical devices limit their widespread adoption. In summary: TOTP for 90% of needs, email OTP as a backup, and hardware tokens only for ultra-sensitive accounts.

01 Tem 08:47

I personally prefer **TOTP-based authenticator integration**, especially with modern tools like Bitwarden or 1Password. This way, I can balance security and ease of use. While manual SMS/email options offer simplicity, they leave you vulnerable to SIM swap attacks or email breaches—something I've seen exploited in recent banking account hacks. Hardware tokens (like Google Authenticator or YubiKey) require physical access and carry the risk of loss, which is a major downside for me. With TOTP, I can sync many services without device registration, and most password managers auto-fill 2FA codes—eliminating the need to manually enter everything. In short, **secure + practical** is best achieved with TOTP + a password manager in my opinion.