I'm reading RFC 6238 and it looks like it's based on a single shared secret:

> Basically, the output of the HMAC-SHA-1 calculation is truncated to > obtain user-friendly values: > > HOTP(K,C) = Truncate(HMAC-SHA-1(K,C)) > > where Truncate represents the function that can convert an HMAC-SHA-1 > value into an HOTP value. K and C represent the shared secret and > counter value;

Does that mean it's formally/theoretically equivalent to simply having two separate passwords?