Please note: I'm not necessarily talking about what happens when one shoulder surfs someone inputting a OTP. I'm fairly confident that it's nearly impossible (or extremely impractical) to guess the next or any available password based upon one.
What I'm asking is related to how a seed might be stored in a password list, as an example.
The scenario:
SELECT * FROM Passwords;
Now, within this table, is it likely that a OTP RNG seed/serial number/keyfob id is stored? If it is, is it possible an attacker might be able to assume or know the site's standardized OTP generator device or application (It would be usually safe to assume there's only one device used) and use the seed to generate valid OTPs?
If I'm using the terminology incorrectly, a specific example would be Google Authentication. How is the number it generates linked to be valid against only one account? How can someone who has the link not be able to generate an identical number list?
Related: How to store OTP seed securely at the validating server I'd accept this as close enough.