Nitpicking: '... or a counter on the token/device'.

As far as I know Google Authenticator allows both time and counter based accounts. Not that it changes anything regarding the GP's misconception about accessing external services.