So I use a password manager with to generate a (strong) unique password for each and every site I have a username / password for.
For the ones that allow it I also enable TOTP (Time-based One-Time Password) 2TF.
This got me thinking.
Theoretically the only way somebody would get their hands on my password (excluding MTM attacks) would be for the password table of the site I'm using to leak, at which point in time the TOTP seed would leak too.
So what exactly is TOTP supposed to be protecting against? Is it intended as a protection against: MTM, key logger, over-the shoulder viewer?