Comment by AnthonyMouse

There is a simple and highly accurate heuristic to tell if a security measure is reasonable:

Is it an open standard that anyone can permissionlessly implement?

When the answer is yes, there is a high probability that it's something reasonable, e.g. TOTP.

When the answer is no, what you will find behind the curtain is either a fool or a crook.