Re:Protectimus TOTP tokens with time synchronization are goi...
by geofft on Tuesday April 30, 2019 @05:49PM
(#19792345)
Are there servers that don't sufficiently deal with clock drift on their own? (And TOTP devices that drift their clock by more than a few minutes a year?)
[ Parent
| on HN ]
Re:Protectimus TOTP tokens with time synchronization are goi...
by icebraining on Tuesday April 30, 2019 @07:52PM
(#19793194)
Searching for "TOTP drift" seems to indicate it's a problem. I'm personally not very knowledgeable, but I've used a few TOTP libraries, and I don't remember any actually recording the detected drift like the RFC recommends. At most they allow for some drift from the current time, but that's usually up to 1-1.5mins, so if the token drifts more than that, it won't work.