[Master_Odin]

A number of sites I've signed up for recently have required TOTP to be setup, but did not provide back up codes at the same time. There's a lot of iffy implementations out there.

[GoblinSlayer]

The totp recovery code is just a base32 encoded secret key, which is also present in qr encoded url.

[cottsak]

gross