News for hackers. Stuff that matters.

A comment on Gitlab Critical Security Release. Parent comment

Re:Gitlab Critical Security Release by shaicoleman on Saturday February 26, 2022 @12:07PM (#30479427)
It already recorded in the database when the TOTP was last used, but it allowed to reuse the same code during the grace period (30 seconds later).
[ Parent | on HN ]
Re:Gitlab Critical Security Release by diarrhea on Saturday February 26, 2022 @02:32PM (#30480975)
Allowing authentication not only within the original time frame but one interval before and after is by design: https://en.wikipedia.org/wiki/Time-based_one-time_password#S... .
[ Parent | on HN ]
Re:Gitlab Critical Security Release by prplr on Saturday February 26, 2022 @02:57PM (#30481214)
The security issue is with allowing reuse, and not because of allowing use in the previous and next time frames.
[ Parent | on HN ]