Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Still doesn't matter. If you're guessing at random, you have a roughly one in a million chance of getting it right each time.

(Actually, the odds are a little better than that, because most TOTP implementations mitigate clock skew by allowing clients to enter codes from a "window" of a few minutes surrounding the current time.)



There is a window of validity (often 30s), and a window of forgiveness (often +- 30s, so the same code will work for 90s), but the standards require only one attempt per window which renders TFA's claim pointless. Except for poor implementations, of course. And once in a million windows it may be 000000 (with 30s windows that will take 347 days assuming even distribution)




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: