[davidhyde]

Maybe you could use the secure connection to resync the time or some other clock with the authenticated server. I guess that’s just another request / response type of arrangement though. And then any breakdown of communication for an extended period of time would brick the whole thing.

EDIT: Maybe the time based one time password algorithm can be configured to be made less time granular (say daily) so that it can handle clock drift.