Online OTP systems, like sending code to a phone is secure because the attacker cannot know the code if he doesn't have the phone or can intercept the content of the message.
And intercepting the message is easier than stealing a physical device. It can be done from another country, in a massive scale.
SMS, for example, can be easily hijacked, either by SIM swapping, or by using SMS re-routing systems. There are lots of applications that monitor SMS on the phone and send it somewhere else.
Email isn't any better. If the attacker manages to control any router in the email route, any message coming by that router can be intercepted. Unless the email content is encrypted, they can be read.
But what about STARTTLS? Sadly, it's more for show than anything. The initial exchange on the SMTP conversation is on clear, and if the server advertises he supports TLS but the client does not accept, the entire exchange is on clear. If the server provides a mismatched certificate, the exchange continues as normal:
TLS is intended to ‘fail open’ in the event of send failure, rather than ‘failing safe’ (whereby if errors occur, the email fails to send at all). Thus in the event of failure, TLS falls back to regular SMTP and messages are sent in clear text.
However, offline OTP looks not secure, because it doesn't need a network connection.
Quite the opposite. Without network connection, an attack cannot be made on a large scale. Hacking the SMTP server of a regional ISP means an attacker can steal any online OTP code from email. But stealing offline OTP codes means hiring a horde of thieves stealing phones from people.
It's not so different from using just a password. If the attacker knows the public key, he can use the key with the algorithm and make the same OTP code with his local system.
It's way different from a password. The vast majority of passwords are easy to break. For example, researchers cracked more than 11 million passwords on the infamous Ashley Madison leak. A paper on leaked passwords shows that lots and lots of people reuse passwords, so one leak can compromise several other accounts for the same person.
OTP is created by the system, not the user. This guarantees way more entropy than a password. And if an attacker steals both the bcrypt hashes and OTP shared secret of your account at Gmail, it will do nothing to help break Facebook, for example, if both are using OTP.
I'm not sure the offline OTP system is secured.
It is. Way more than a password. You should get a password manager, and enable OTP on every single service you use, and let the password manager generate all passwords for you.
