Tokens need to be single use or you create a new side channel already. Time limiting is also a challenge without creating a side channel, though possible with a

Tokens need to be single use or you create a new side channel already. Time limiting is also a challenge without creating a side channel, though possible with a similar mechanism to 2FA.