One-time passwords (OTPs) usually serve as the 2nd factor in a 2FA scheme. But, in isolation, I believe they are more secure than passwords, since they are ephemeral and passwords are still badly reused in the wild. Unless end-to-end encryption or some strict usability issue is involved, I can't really see a case where passwords are superior.

From my experience, the current state of affairs in authentication is:

  • Virtually every service demands password for authentication.
  • Some allow users to turn on 2FA, which is usually done by OTPs.
  • Few support "passwordless" authentication, meaning an OTP is sent to an email. I use quotes here because this is a misnomer. Users still need a password, but to a different service (their email).

What I have never seen is a service that allows OTP only authentication. In this case, a password could very well serve as the 2nd factor.

Is there any particular security reason for why is this the case?

  • 1
    Related: security.stackexchange.com/questions/37203/…
    – mti2935
    Commented Aug 2, 2022 at 11:12
  • This has been asked a few times.
    – schroeder
    Commented Aug 2, 2022 at 11:38
  • The short answer is that TOTP is not designed to be a primary factor and hence is not secured to be such. You could re-engineer the process to be more secure, but then you are designing something different. PAM tools do this type of thing (ephemeral passwords) but are not designed for public enrollment.
    – schroeder
    Commented Aug 2, 2022 at 11:42
  • @schroeder thanks for the pointers and summary. Too bad all those answers are heavily opinion based and unconvincing. I guess I'll need to resort to academic stuff to see if anyone researched that.
    – sourcream
    Commented Aug 2, 2022 at 12:05
  • 1
    Why do you need "academic" studies? The protocols and definitions are enough. datatracker.ietf.org/doc/html/rfc6238 The seed is not protected in the same way that passwords are.
    – schroeder
    Commented Aug 2, 2022 at 12:09