4 ms·
I find this awfully thin. About every device that does TOTP by default takes its time from the network provider, and lets the user set the correct timezone, and
by kokx 6y ago
I find this awfully thin. About every device that does TOTP by default takes its time from the network provider, and lets the user set the correct timezone, and makes it even really easy to do so. Since most DST settings for timezones in the world are quite predictable (yes I am aware that there are few that have last-minute changes, but most don't, especially not in developed nations), most people never have to adjust their timezone because of DST.
Though I do suspect that Google Authenticator even has some logic to reduce these problems, since you can "sync" its time in the settings.
- JimDabell 6y ago“Lets the user set the correct timezone” is where this falls down. The user doesn’t always get this right. Once that happens, the time looks correct for a while, then looks wrong all of a sudden. So they go into their settings and manually change the time. At that point taking time from the network provider no longer happens, because they overrode that. The predictability of DST doesn’t help, and “most people never have to adjust their timezone” isn’t relevant either. Perhaps you didn’t fully grasp what was happening in the example? All of the machinery works correctly, it’s just the first time they set up the computer the timezone was wrong, or they moved. Everything after that point can work correctly, but if that thing is wrong, UNIX time will be wrong even if the time looks right to the user. I’ve literally had to fix this problem for people. “Correct” time, incorrect timezone. It’s not a theoretical example.