You'll see this in CTFs sometimes. Each guess gives the attacker a one in a million chance of guessing the TOTP. If the attacker can figure out a username (usua

You'll see this in CTFs sometimes. Each guess gives the attacker a one in a million chance of guessing the TOTP. If the attacker can figure out a username (usually easy) and the log in API isn't rate limited, then they can just guess codes in a loop. It take about 12 days to make one million guesses at one request per second. Most TOTP apps allow codes that are older/newer, and the attacker may be able to use a higher RPS. I guessed a TOTP in 30 minutes for one CTF, for example. So pretty insecure, but probably suitable for some systems with low security requirements or other mitigating factors.