Hmmmmm. Past 2FA codes is something that had‘t occurred to me. They are compelling because change every X seconds, and presumably can be a length that makes the

Hmmmmm. Past 2FA codes is something that had‘t occurred to me. They are compelling because change every X seconds, and presumably can be a length that makes them unique enough. In terms of the threat of having a single “signer” fake it: does anything prevent them from generating “old” codes by setting the clock back?