only the counters are used for otp validation, not timestamps