Comment by yread

I think it's rather this millenium's "just check the domain really carefully". You can't choose a weak TOTP, write it on a post it or share TOTPs on multiple websites. The main (only?) failure mode is that you type it in an attacker-controlled input.