Hacker News Reader

What about using a time based one time password algorithm instead of a challenge-response mechanism? Most embedded systems have a real time clock. Would it make sense to use this technology for that? https://en.m.wikipedia.org/wiki/Time-based_One-time_Password...

View on HN

RTCs are actually quite rare, especially in a lot of the lower power RF SoCs.

Drift would also be an issue - most move at least 10 minutes a year. That's with good temperatures, not being left in a hot car or at body temp.

If you could solve the drift issue then it would be pretty good I think, it's an interesting idea.

Maybe you could use the secure connection to resync the time or some other clock with the authenticated server. I guess that’s just another request / response type of arrangement though. And then any breakdown of communication for an extended period of time would brick the whole thing.

EDIT: Maybe the time based one time password algorithm can be configured to be made less time granular (say daily) so that it can handle clock drift.

Reply on news.ycombinator.com