[tigereyeTO]

Author also confuses backup codes with TOTPs.

[sam_lowry_]

OP here. It's a typo and should read OTP.

This accidental confusion between TOTP and OTP is by itself an argument against complex alternatives to login+password.