[withinboredom]

I think what’s important here is when there can’t or won’t be a “lock out” after a certain number of tries. I’ve seen a few door locks based on TOTPish. They won’t lock you out because who knows why. You can just stick a device outside the door, slamming the BLE endpoint with codes until it unlocks, sorta like a proxmark used to do for keyless entries (maybe still does, haven’t messed with them since ‘08ish)