Comment by barbegal

An interesting idea but in theory just three correct pass codes and some brute force will reveal the secret key so you'd have to be very careful about only inputting the pass code to sites that you trust well.

It's definitely computable on a piece of paper and reasonably secure against replay attacks.