In addition to my question: How many known time/result combinations does it take to guess a HOTP/TOTP secret?.
I've read often that TOTP is more secure than HOTP. One example:
TOTP provides higher security due to its time-based nature, reducing the window of opportunity for an attacker. If the company requires stricter security, TOTP might be the preferred option, especially as a second authentication factor for step-up authentication. - https://www.descope.com/blog/post/totp-vs-hotp
But I tend to disagree. I think that HOTP is more secure. Time is actually something that an attacker is much more likely to know. Especially when you can see a generated code either typed in by the user in a non-masked input field, fetched through MitM, or seen in a generation app by means of shoulder surfing. A counter is something the attacker is much less likely to be able to know, unless it's a a bad implementation of counters such as starting at 0 and doing +1 every time, then it becomes suddenly very brute-force-able. Or unless there is a bad implementation in a software generator app and the counter is just extractable from memory or disk. Which is much harder than simply knowing the time of generation.
I did see an custom implementation of a combined HOTP and TOTP recently which seems even stronger than HOTP or TOTP alone in my opinion as it uses two factors and makes is even harder to crack. However that's not commonly used and out of the two, TOTP is being the most commonly used (from personal experience).
I understand that from a management point of view (and therefore indirectly from an availability point of view) a out-of-sync time issue is much easier to manage and fix than a out-of-sync counter that needs resync. Despite that, is TOTP actually harder to crack and more secure than HOTP and why? If so, why is TOTP the preferred implemented method instead of HOTP?