I haven't really looked into this, but is this really more secure than passwords? Ok, ignoring the majority of passwords are something like `password`, given you store the secret key in plain text, if your database gets hacked, doesn't that mean you can access everyones account?
Isn't a good use of 2 factor authentication is that you log the machine that a user regularly logins in from and if they try to use a different machine, it asks for the one time code?
yes, it's. that is the wayGoogle, Facebook, Twitter.. use it
no, if your database is hacked you still need to decrypt passwords in order to access to accounts, remember that 2-fact auth is just a extra-layer of protection, you still need to bypass traditional security schema