To add to /u/randybruder's excellent overview, it's also worth noting the value in redundancy. I absolutely love 1Password auto-filling the OTPs, so I do just keep both my account passwords and the TOTP secrets in 1Password. Eventually the additional security comes at the cost of user inconvenience. However, I’d say a 1Password account is already so secure, it’s like the difference between having 10 locks on your front door or 12.

So technically yes, using the built in authenticator in 1Password would make you more vulnerable. Storing both an accounts’ password and the TOTP secret in 1Password means an attacker would only need to gain access to one thing your 1Password account. The point of 2FA authentication means for an attacker to breach your Google account (or any account you set up 2FA on), they would need to gain access to two things: 1) your 1Password account where the username and password is stored, and 2) your physical phone where the separate 2FA authenticator app exists and is the only device capable of generating the one time passwords. Put simply: the device that holds your TOTP secret should never hold your password if your aim is genuine two factor security. Indeed, when you store your TOTP secret in the same place that you keep your password for a site, you do not have second factor security. One time passwords are often part of second factor security systems, but using one time passwords doesn’t automatically give you second factor security. We need to make the distinction between one time passwords and second factor security. You’re right to consider that a vulnerability-in fact 1Password themselves say that too: Are you talking about setting up 2FA on a website (like say your Google account) and then having 1Password be the OTP authenticator?

1password google authenticator