[tptacek]

This would make sense if virtually every website in the world didn't react to the short-term TOTP secret by handing back a long-term HTTP secret.

[lmm]

If there's no point improving client authentication until you've improved website security and no point improving website security until you've improved client authentication then neither will ever get better.