The TOTP QR Code Is a Secret-Enrollment Ceremony
Scanning the QR code transfers long-lived secret material; it should be treated more carefully than an ordinary setup screen.
TOTP
Clock Synchronization Is Part of the Authentication System
A correct TOTP secret can still fail when the verifier and authenticator disagree about time.
MFA Recovery Is Not the Same Problem as Password Reset
Losing the authenticator device creates a second-factor recovery problem that should not silently collapse to the password path.
What a 30-Second TOTP Window Actually Means
TOTP is not a random six-digit number every half minute; it is a deterministic moving-factor calculation with a strict verifier window.
Google Authenticator Is a TOTP Client, Not the Authentication Server
The six-digit code comes from a shared TOTP secret and time step; Google Authenticator is only one compatible client.