Multiple still tie user to specific devices. It will not work on a friends machine (unless user memorises the shared secret used for hashes). TOTP is essential

Multiple still tie user to specific devices. It will not work on a friends machine (unless user memorises the shared secret used for hashes). TOTP is essentially a glorified password (which is the shared secret), only so long that the user presumably does not remember it, so it is taken as a representation of a trusted device access. TOTP / HOTP are close to manual CHAP. I don't feel two passwords (the real password and TOTP shared secret) are better than one.