With some services that use standard 6-digit TOTP codes, they also offer the ability to have a set of backup codes, in case you lose your two factor device.
With Google, for example, you can print out a hardcopy of 10 backup codes. These are more than 6 digits, so that isn't worrying.
However, some other sites that generate backup codes do use 6 digits. Reddit, for example, is rolling out two factor authentication, and their 10 recovery codes are all 6 digits, which is the same length as a standard two-factor code they use.
Does this mean that those 10 codes are somehow never going to be generated at random by the TOTP seed key? Since they're using a standard algorithm (used by Google Authenticator, Authy, etc), I assume every 6 digit number is possible.
Alternatively, does that mean that over time, some of these codes will become invalid, assuming the TOTP algorithm generates that code? Or even longer term, if I log in many times, I imagine I'll run across one of these codes eventually, use it to login, and unknowingly remove that code from my backup list.
What can be implied about a setup where the two-factor recovery codes are the same number of digits as a standard two-factor code?