3 ms·

One aspect I find puzzling is why most two-factor authentication (2FA) applications restrict authentication to only a single valid code at any given time. This

by smokel 1y ago

One aspect I find puzzling is why most two-factor authentication (2FA) applications restrict authentication to only a single valid code at any given time. This constraint inevitably creates a window during which it is inconvenient or impractical to copy the code to another device. Allowing the previous code to remain briefly valid would eliminate this unnecessary delay, enhancing usability without significantly compromising security.

brewdad 1y ago
Ente Auth displays the current code and the next code so you can choose whichever best meets the time remaining until the changeover. It’s a nice usability feature.
fredley 1y ago
FWIW 2FAS starts to show you the next code near the end of the window, this is very handy https://2fas.com/ https://2fas.com/
conradludgate 1y ago
Have you actually tried writing a code close to the expiry window? I've definitely submitted codes a few seconds after the expiry and had them still be accepted
- michaelt 1y ago
  Some users clocks are a minute or two out, so sensible TOTP implementations will actually accept about 5 codes to account for clock error.
_Algernon_ 1y ago
Since totp codes are time based and there is no guarantee that time of the generating device, and the verifying device are exactly identical they usually allow some room for error. You'll probably be fine entering the code before or after for example.
zie 1y ago
See RFC-6238: https://www.rfc-editor.org/rfc/rfc6238 https://www.rfc-editor.org/rfc/rfc6238 This is all in the standard, most places have implemented one of the options. I've implemented all of the options at least once. It's configurable based on how lax/secure you want to be. Most places I've dealt with allow the previous and next code to also be used, so instead of a 30s window you actually have a 1.5m window.
JamesSwift 1y ago
I believe every single 2fa system I've used accepts either the current code or the one directly prior.

by smokel 1y ago

brewdad 1y ago

Ente Auth displays the current code and the next code so you can choose whichever best meets the time remaining until the changeover. It’s a nice usability feature.

fredley 1y ago

FWIW 2FAS starts to show you the next code near the end of the window, this is very handy https://2fas.com/ https://2fas.com/

conradludgate 1y ago

Have you actually tried writing a code close to the expiry window? I've definitely submitted codes a few seconds after the expiry and had them still be accepted

michaelt 1y ago
Some users clocks are a minute or two out, so sensible TOTP implementations will actually accept about 5 codes to account for clock error.

_Algernon_ 1y ago

Since totp codes are time based and there is no guarantee that time of the generating device, and the verifying device are exactly identical they usually allow some room for error. You'll probably be fine entering the code before or after for example.

zie 1y ago

See RFC-6238: https://www.rfc-editor.org/rfc/rfc6238 https://www.rfc-editor.org/rfc/rfc6238 This is all in the standard, most places have implemented one of the options. I've implemented all of the options at least once. It's configurable based on how lax/secure you want to be. Most places I've dealt with allow the previous and next code to also be used, so instead of a 30s window you actually have a 1.5m window.

JamesSwift 1y ago

I believe every single 2fa system I've used accepts either the current code or the one directly prior.