@kkarhan @BrodieOnLinux to me TOTP seems like a perfectly reasonable solution to multi-factor auth. I agree that if you take it seriously you are generating tokens on a device that is not the one you are logging in with, but you can do that with a phone, a crappy laptop, or even some of the various usb devices. Some will even act as a keyboard.

The thing with iTAN is that you need to maintain a whole list of tokens, and I imagine a responsible implementation would only allow each token to be used once which means you have to keep track of which ones you've used. If anyone sees the list (or takes a photo) they can compromise you a lot easier than if someone sees a time based token that will only work within a small window and never again. Yes some math is involved, but in my opinion it is a better proof of authenticity than a token that was generated some ambiguous time ago. I don't want to have to go to the gun safe every time I have to do something on Github that requires a token.