Reading about TOTP-based authentication systems that use smartphones as one-time code generators, I seem to understand that typically the shared secret is generated automatically by the "server" (the system to which the user must authenticate), then encoded in Base32 or other encoding that results in "human readable" characters only, and then the user enters that secret in his/her smartphone app that will be used to generate the one-time codes. Often the server-generated secret is encoded into a QR code to be scanned with the phone to make it easier for the user to enter the secret into the app.
Assuming that it is true that the above is a typical configuration (which I'm not sure about), I am wondering what would be the disadvantages of making the user choose the shared secret and communicate it to the server to be stored, instead of the other way around.
That is, the user would create the shared secret and save it both into his/her smartphone app and into the server, and the server would use such secret as is (I mean without considering it as encoded). Or, the user would create the secret and encode it into Base32 before saving it into the server, and the server would consider it as encoded.
Since in my understanding none of these two cases is how a typical TOTP system works, I am sure that there are reasons why the user is not made choose the shared secret, and I would like to know them.
ADDED: I got quite a bit of info here that clarified a lot of my doubts. But I still have a doubt. As I understood, much of the point of two-factor authentication is to combine something you know (your regular password) and something you have (the code-generating device), but the device can be a common smartphone and it becomes the code-generating device only thanks to the user entering the secret into it (it doesn't matter how, QR code or keyboard or other, it's still a piece of info the user needs to know and that is all it takes). I wouldn't know what to reply to someone claiming "the secret is something you know or have just as much as the password is".
In other words, I do understand how the code-generating device that the bank gives to the user to login is something the user has and not something the user knows, and that's because that device had the secret set into it before being given to the user, so the user doesn't know the secret, so if the user successfully authenticates it means that it was actually the person who physically had the device. But if the device is a common smartphone instead, where the user itself is supposed to enter the secret (f.ex. via QR code) then a successful authentication only means that it was someone who knew the secret and had entered it into his/her smartphone.