You didn't provide a secure and practical alternative, please enlighten people unaware of them.
WebAuthn uses FIDO Security keys, relatively cheap USB or Bluetooth devices or sometimes just a built-in feature of a smartphone, to authenticate. They are Something-You-Have, but the WebAuthn protocol also offers:
* Optionally a mode where you give the FIDO key a PIN (Something-You-Know) or biometric input (Something-You-Are) to do all the authentication locally
* Phishing proof - there's no decision about whether this is really your bank. WebAuthn is completely happy to log you into https://fake.bank.phishingsite.example/ but the credentials are useless to the crooks who own that site because they won't work on https://your.actual.bank.example/ even if the crooks got the logo just exactly right and wrote a very convincing pleading email from your bank saying they definitely need you to go to the fake bank site.
That turns multi-factor auth back into "single factor auth" and leaves you one exploit away from having your password and TOTP code from getting stolen.
Am I misunderstanding something? Or did you mean OTP rather than TOTP?
That string is all that is needed to generate all of the TOTP codes forever. So while the TOTP code that you type is different every minute, it's generated by doing some math on the setup string and the current time.
Some password managers (like 1Password) allow you to have them generate your TOTP codes by putting in your setup string into them (often using the exact same process you would do to setup your TOTP codes in an app). But i'm saying that's not a good idea if you are going for "most secure", because at that point if something were to somehow exploit your password manager, they will not only get your username and password, but will have that setup string as well so they can generate their own TOTP codes for you.
It’s arguable that you’re removing that second factor when you store the parameters needed to create the TOTP in the same place as you store your passwords.
It is a security tradeoff that I take for most of my accounts. For a few that a much more sensitive I use a Yubikey.
But unless you have your 1Password setup to need the secret every time you go to have it fill in the password, the seed string is in memory unencrypted along with your passwords (or more specifically, it's stored in a way that it can be decrypted by the app/extension on it's own). That makes it one spectre/meltdown style exploit away from getting everything needed to login to the account.
Still, if that system works for you, then good! having any 2fa (even SMS) is better than nothing, storing TOTP codes in a password manager is better than SMS, storing them in a seperate device is better still, and U2F keys are even better still.
Like anything it's a gradient of tradeoffs, but I've seen too many people go from Google Authenticator to 1Password in an attempt to further secure their account, and I just like to point out that there's a good chance it's doing the opposite.
This works on vacation when I can't receive SMS. It was much cheaper to buy a 4G SIM in Barcelona (for Google Maps etc) than enable international roaming from Australia ($AU5/day).