I don't see how TOTP/2FA can avoid the problem of user password re-use. The password has still been reused, whether an extra layer of authentication is used or not.
Maybe you can say that it mitigates it, but I don't think it avoids it at all.
Maybe you can say that it mitigates it, but I don't think it avoids it at all.
The sum of the authentication credentials passed to the application is different for each site. with 2FA you submit password + token. so an attacker who is replaying compromised credentials can't gain unauthorised access with them alone.