They do work for capturing secrets for 2-factor authentication into an app such as Google Authenticator, which implements an ISO OTP standard. Any site with username/password should really generate a OTP secret as QR code to scan into one's phone!