Hacker News Reader

Comment by crazygringo | Hacker News Reader

It's still exhausting.

Literally every time I pay for something via PayPal on my computer, I need to pull out my phone, find the authenticator app, open it, scroll to PayPal, tap it, see if there's enough time for this code or if I should wait for the next one, type the 6 digits into the site...

I mean it takes half a minute, and this easily gets repeated several times a day if you engage in a lot of transaction-type things. And it's no faster if it's by SMS or by e-mail because I'm still spending 15 seconds waiting for the message, and then opening it, typing, then going back to delete the message so it doesn't clutter my inbox -- half a minute total again.

View on HN

Not to disagree with the cumbersome process - just want to point out that TOTP codes are valid for 30 seconds after the "expire" (60 seconds total). So as long as you are able to remember / copy the digits, there is no need to wait for the next code even if you don't have enough time to type it in. It will still work.

Tangentially, I really wish authenticator apps continued to show the previous code for 30 seconds so I can continue to refer to it for apps that don't allow copy and paste.

I definitely had no idea! Thanks for that knowledge.

I mean there's never been any UX indication at all that that would be the case. I like your idea of showing the previous code -- that would make it very clear.

Good to know.

To be fair, the reason for this is to account for clock desync between systems, so it wouldn't be correct to say it is still valid for 30 seconds where it might not be in reality. Knowing what this actually means requires understanding the implementation of TOTP, so that you are not surprised in situations where it does fail. The existing authenticator app UX is likely correct for the average user.

TOTP codes are actually valid for 90 seconds, 30 seconds either side of when it’s supposed to be displayed (assuming the display device’s clock is accurate to the second), to allow for up to 30 seconds clock skew on either end, in either direction.

> see if there's enough time for this code or if I should wait for the next one, type the 6 digits into the site...

In my experience on most services (not sure about paypal specifically) there's a grace period where a code that just 'expired' is still valid for another ~10-30 seconds? So... at least you can skip that part.

> see if there's enough time for this code

I haven't tried PayPal specifically, but websites will usually still accept the previous code for at least a few seconds after a new one rolls over

Have you tried a password manager? Many of them will autofill the code for you. It makes it quite seamless.

I thought that defeated the entire purpose of 2FA?

That if your password store got hacked, they still wouldn't have access to your separate 2FA device?

It does to a certain extent but it may be a negligible compromise depending on what you use as your second factor.

https://blog.1password.com/1password-2fa-passwords-codes-tog...

Have you ever done literally anything that is actually exhausting? Because this.... this is not exhausting.

Sounds like a good use case for fido authenticators or passkeys.

Reply on news.ycombinator.com