3 ms·
> Not sure I follow... the sync happens because when the user sends an attempted TOTP code to the server, the server calculates a few codes just before/after th
by icebraining 8y ago
> Not sure I follow... the sync happens because when the user sends an attempted TOTP code to the server, the server calculates a few codes just before/after the current time, and if they match, the server updates its cache of the token's clock drift. Nothing is stored on the client. Why would this not be an option? (It requires the same access as required to send it a code in the first place, no more.)
"The server" here is owned by the site where you're logging into, not by Protectimus, so you can't make it do those things. They found a way to fix the clock issue from the end they can affect.
Plus you need some input anyway, since the TOTP protocol requires a shared secret, and for some reason it became a standard that the server is the one providing it on setup.
- geofft 8y agoAre there servers that don't sufficiently deal with clock drift on their own? (And TOTP devices that drift their clock by more than a few minutes a year?)
- icebraining 8y agoSearching for "TOTP drift" seems to indicate it's a problem. I'm personally not very knowledgeable, but I've used a few TOTP libraries, and I don't remember any actually recording the detected drift like the RFC recommends. At most they allow for some drift from the current time, but that's usually up to 1-1.5mins, so if the token drifts more than that, it won't work.