I have seen many experts advising usage of some kind of OTP as second step of 2FA schemes.
I fully understand 2FA is more secure than Single Authorization, but it is also more inconvenient for casual user.
We currently have schemes with "strong passwords" changed on regular basis and many users are complaining.
I am wondering if replacing passwords with HOTP (possibly google-authenticator, supported by google-authenticator-libpam) would result in lower security than our present scheme.
Question is:
Using google-authenticator-libpam is considered more or less secure than password (8 chars, mixed case, numeric & special chars)?
If viable, what are pitfalls (if any)?