Hacker News Reader

Comment by leni536 | Hacker News Reader

About the "validity" period: in practice it seems to be more like a rotation period, the code themselves seem to be valid longer than this, that is you can often enter them for quite some time after they get rotated.

And I also often wonder about the OTP aspect, whether there is any protection in TOTP backends for the same TOTP being used twice.

View on HN

The validity is up to the service, as described in https://datatracker.ietf.org/doc/html/rfc6238#section-5.2

Because of clock skew and latency, a service might choose to allow the previous and/or next code as being acceptable.

They repeat roughly every year. 1,000,000 periods of 30 seconds is just less than 350 days.

They do not repeat. The totp is calculated with the whole Unix timestamp, not a cyclical counter.

Yes, but there are only 6 digits available. So a million different codes can be generated. A new code is generated every 30 seconds

Rather pleasingly, 30,000,000 seconds is roughly 1 year.

So, assuming a uniform distribution of codes, you would expect to see a repeat after a year.

A code may be repeated, but they should not enter a cycle (which would be a real disaster.)

You also need to keep in mind the birthday paradox. Repeated codes will happen with high probability after around sqrt(1,000,000) = 1000 code emissions. https://en.wikipedia.org/wiki/Birthday_problem

I am not sure whether TOTP can be used two times, but that longer validity aspect already lead to a vulnerability called "Microsoft MFA AuthQuake"

Reply on news.ycombinator.com