Migrated from ServerFault, as advised there.
I have seen many experts advising usage of some kind of OTP as second step of 2FA schemes.
I fully understand 2FA is more secure than Single Authorization, but it is also more inconvenient for casual user.
What about replacing passwords with HOTP (HMAC-based One-time Password algorithm)?
We currently have schemes with strong passwords (not really so strong, current policy is: 8+ chars, mixed case, at least one numeric and at least one special) changed on regular basis and many users are already complaining.
I am wondering if replacing passwords with HOTP (possibly google-authenticator, supported by google-authenticator-libpam) would result in lower security than our present scheme.
Rationale is long random (generated) passwords will force users to write them down in some "handy" place, usually somewhere an attacker will find easily. Using [H]OTP would render this useless, while still being convenient as everybody has a smartphone on the desk, today.
Am I forgetting something important?
Is google-authenticator (or other OTP scheme) fundamentally flawed somehow?
If viable, what are pitfalls (if any)?
Note 1: I know multiple questions are usually badly received, but this really boils down to: Can I use this with reasonable security?
Note 2: We are not concerned with absolute security (as if such a beast would exist in the real world), but we wouldn't want to lower security level we have now either.