Timeline for How does Google Authenticator work?
Current License: CC BY-SA 4.0
14 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Mar 29, 2021 at 15:41 | comment | added | cornelinux | @Auspex you are right. The counter could vary between two authenticator apps with the same seed. But on the other hand, I would simply "guess" the counter while after while. According to the RFC the auth server should have a count window. So I would simply increase the counter by - lets say - 9 and try to login one or two times per day. After a few days I would most probably hit a matching OTP value. | |
| Mar 29, 2021 at 10:40 | comment | added | Auspex | @cornelinux You're right about TOTP, but surely with HOTP a second device would need to know how many times the other device has connected to work. | |
| S Feb 9, 2019 at 15:10 | history | suggested | maxschlepzig | CC BY-SA 4.0 |
fix key-uri link, make all links https ones
|
| Feb 9, 2019 at 13:43 | review | Suggested edits | |||
| S Feb 9, 2019 at 15:10 | |||||
| Apr 20, 2017 at 14:46 | comment | added | cornelinux | As @TerryChia pointed out, the secret key is in the QR code. Be aware of the sensitivity of the QRCode/Information. I wrote a blog post a while ago netknights.it/en/the-problem-with-the-google-authenticator | |
| Nov 4, 2013 at 13:10 | history | edited | user10211 | CC BY-SA 3.0 |
added 3 characters in body
|
| May 7, 2013 at 11:03 | comment | added | Mario Awad | Thank you for the well defined answer and followup. Quick summary of section 7.4: Resynchronization of the Counter every now and then and a look-ahead window for the counter is what makes things work without requiring instant-sync. | |
| May 7, 2013 at 8:24 | comment | added | user10211 | @MarioAwad The answer to that can be found on the HOTP RFC, section 7.4. ietf.org/rfc/rfc4226.txt | |
| May 7, 2013 at 8:21 | comment | added | Mario Awad | In the case of HOTP, how does Google Authenticator know that I have "used" the password without syncing with the server? What Google Authenticator does is that it continues to flash different keys and I can just use any one them without giving feedback to my mobile. | |
| S May 1, 2013 at 19:31 | history | suggested | yoozer8 | CC BY-SA 3.0 |
Grammar cleanup
|
| May 1, 2013 at 19:11 | review | Suggested edits | |||
| S May 1, 2013 at 19:31 | |||||
| May 1, 2013 at 18:15 | vote | accept | CommunityBot | ||
| May 1, 2013 at 15:49 | history | edited | user10211 | CC BY-SA 3.0 |
added 346 characters in body
|
| May 1, 2013 at 15:36 | history | answered | user10211 | CC BY-SA 3.0 |