I don't think I've ever heard of people actually brute forcing TOTPs on any halfway decent implementation. Since they rotate every so often you'd have to hit th

I don't think I've ever heard of people actually brute forcing TOTPs on any halfway decent implementation. Since they rotate every so often you'd have to hit the whole range of 000-000 to 999-999 in like 15 seconds. A simple rate limit of only allowing a few tries every 30 seconds would completely prevent TOTP brute forcing while still being plenty accessible.