Protectimus TOTP tokens with time synchronization are going on sale tomorrow

Re:Protectimus TOTP tokens with time synchronization are goi... by icebraining on Tuesday April 30, 2019 @11:25AM (#19788774)

> Not sure I follow... the sync happens because when the user sends an attempted TOTP code to the server, the server calculates a few codes just before/after the current time, and if they match, the server updates its cache of the token's clock drift. Nothing is stored on the client. Why would this not be an option? (It requires the same access as required to send it a code in the first place, no more.)

"The server" here is owned by the site where you're logging into, not by Protectimus, so you can't make it do those things. They found a way to fix the clock issue from the end they can affect.

Plus you need some input anyway, since the TOTP protocol requires a shared secret, and for some reason it became a standard that the server is the one providing it on setup.

[ Parent | on HN ]

Re:Protectimus TOTP tokens with time synchronization are goi... by geofft on Tuesday April 30, 2019 @05:49PM (#19792345)

Are there servers that don't sufficiently deal with clock drift on their own? (And TOTP devices that drift their clock by more than a few minutes a year?)

[ Parent | on HN ]

Re:Protectimus TOTP tokens with time synchronization are goi... by icebraining on Tuesday April 30, 2019 @07:52PM (#19793194)

Searching for "TOTP drift" seems to indicate it's a problem. I'm personally not very knowledgeable, but I've used a few TOTP libraries, and I don't remember any actually recording the detected drift like the RFC recommends. At most they allow for some drift from the current time, but that's usually up to 1-1.5mins, so if the token drifts more than that, it won't work.

[ Parent | on HN ]