For those curious on how to find that ~1200 values are needed before a 50% probability of collision, this is a generalized form of the birthday problem [0].
With a calculator [1], we can find the exact amount. plugging in D=10^6 (# of unique codes) with P=0.5 (odds of collision) gives you 1178 values.
The very rough rule of thumb that I think one should remember is: You get a 50% chance of collision with sqrt(total) samples.
Sqrt(1 000 000) = 1 000, close enough to the exact number you calculated.
Re:How random are TOTP codes?
by ColinWright on Friday July 05, 2024 @05:52PM
(#40886368)
More accurately, for 50% it's \sqrt(\ln(4))\sqrt(N) which is \sqrt( ln(4) N ).
That's about 1.17741 times \sqrt(N).
The reasons are explained here: https://news.ycombinator.com/item?id=40886363
There’s only a million 6 digit TOTP codes, so I reckon you get to 50% odds of collision at ~1200 values.