undefined | Better HN

0 pointsdzhiurgis4y ago0 comments

Does it assume that each code is new and not repeated? Because they can def be duplicates.

0 comments

Still doesn't matter. If you're guessing at random, you have a roughly one in a million chance of getting it right each time.

(Actually, the odds are a little better than that, because most TOTP implementations mitigate clock skew by allowing clients to enter codes from a "window" of a few minutes surrounding the current time.)

gnabgib4y ago

There is a window of validity (often 30s), and a window of forgiveness (often +- 30s, so the same code will work for 90s), but the standards require only one attempt per window which renders TFA's claim pointless. Except for poor implementations, of course. And once in a million windows it may be 000000 (with 30s windows that will take 347 days assuming even distribution)

j / k navigate · click thread line to collapse

0 comments

duskwuff4y ago

Still doesn't matter. If you're guessing at random, you have a roughly one in a million chance of getting it right each time.

gnabgib4y ago

j / k navigate · click thread line to collapse