4 ms·
No connectivity is required, it's TOTP on a 30-second interval. The tl;dr: is that you have a shared secret (so if this ever gets leaked to an attacker, yes, yo
by joatmon-snoo 10y ago
No connectivity is required, it's TOTP on a 30-second interval. The tl;dr: is that you have a shared secret (so if this ever gets leaked to an attacker, yes, you're vulnerable) which is used in conjunction with current time (give or take a few seconds) to generate a code you can use to confirm authentication.
- justinclift 10y agoThanks. :)
- wonderfool 10y agoThis may sound silly, but keep in mind that TOTP requires that both ends agree on the current time. I learned this the hard way when my authenticator stopped working consistently. Apparently I had disabled my device's (the one with the authenticator app) "automatically set time from NTP" feature. Over time this resulted in my device's clock drifting X seconds away from the providers' clock(s), which in turn resulted in my occasionally using codes that were already X seconds expired.
- eru 10y agoThe counter based OTP is actually more secure, but Google doesn't go for them with end-users, because they can go out of sync (eg if your kid is idly flicking through a lot of them on your phone) and then have to be reset.