New answers tagged one-time-password
This is how I would do it. Have the web app generate a public/private pair (say DH). Show the public key on the screen as QR code, the user then scans it with the phone. From this point onward, the phone can send anything to the web app securely.
RFC 4226 was defined way before google formed the idiom of "two step verification". Two step verification does not necessarily has to do anything with HOTP or TOTP. Of course you can use HOTP to create "non-guessable" codes, but it is not necessary. Your service could simply remember which code was sent to the user. In any case you should create a code ...
Top 50 recent answers are included