3 ms·
Doesn't matter. If you keep trying enough random codes for long enough, eventually you'll guess right.
by duskwuff 5y ago
Doesn't matter. If you keep trying enough random codes for long enough, eventually you'll guess right.
- dzhiurgis 5y agoDoes it assume that each code is new and not repeated? Because they can def be duplicates.
- duskwuff 5y agoStill doesn't matter. If you're guessing at random, you have a roughly one in a million chance of getting it right each time. (Actually, the odds are a little better than that, because most TOTP implementations mitigate clock skew by allowing clients to enter codes from a "window" of a few minutes surrounding the current time.)
- gnabgib 5y agoThere is a window of validity (often 30s), and a window of forgiveness (often +- 30s, so the same code will work for 90s), but the standards require only one attempt per window which renders TFA's claim pointless. Except for poor implementations, of course. And once in a million windows it may be 000000 (with 30s windows that will take 347 days assuming even distribution)