I was considering adding HOTP as an option to my website (alongside things such as SMSed one time tokens which I already have). But I was considering one issue that HOTP inherently has:
Things such as the iPhone usually get backed up along with all app data. That would mean, say I'm using Authy to generate my OTP tokens, the secret keys from within Authy would get included in such backups as well. Well, the entire purpose of OTP is so that information on the computer is not enough to break into an account and you need that second factor just in case something such as malware gets onto the computer (if I understood properly). But this backup means, if I have access to your computer, I can get your password through conventional manners such as a keylogger, but I can also look through your mobile phone backups for the HOTP secret key and without your phone, successfully log in.
So what's keeping people from doing that, and why should I also offer HOTP or is it better for me to still just stick with only SMSed tokens?