I think some of the design ideas are a mix of fun and fancy. Having someone use OTP of some form over none is an improvement. Making the code base as simple as possible, transparent and easy to read might make 2FA, I dare say, approachable, and interesting.
SMS has been presented in talks at defcon as insecure, as a little bit of social engineering can grease a carrier into issuing a phone on your account, which can be swapped in for your SIM, so an attacker gets your OTP. Or something like that. https://www.ieee-security.org/TC/SPW2020/ConPro/papers/lee-conpro20.pdf
So there’s no confusion, this is the same exact protocol implementation of Authenticator that you scan a barcode with your phone to get the generator secret into your app. These authenticator apps usually display a code on screen, and you might physically key these codes in. The relevant concerns you presented are in the original use case. A person could feasibly read your codes from across the room.
Perhaps yourself and others might make your own spinoffs? If blinky visible light is bad, maybe use IR, or develop a small NFC library, or use something unique to you.
I’m working on adapting some open source pam code to this first iteration, and if there is some degree of interest I might develop NFC into it or some other means of transmitting HOTP codes.
