2

We are using Time-based One-time Password Algorithm (Google Authenticator) in our system. Since we currently don't allow any time window and code validity is just 30 seconds, we are constantly having issues with time de-synchronization on devices, which generate TOTP codes. That means that users can't login because they enter codes which are either expired or ahead of time.

It seems like it's a general practice to allow "windows", so system would allow codes which are valid at a time, which is close to precise current time. The question is - how long such windows should be? Is there some industry-wide practice? I'm looking at a generally-accepted value, which is practical, given how precise the time usually is on most phones with Google Authenticator and also is secure-enough. Is it 1 or 5 minutes or something else?

  • Have you tried measuring the time drift? I wouldn't expect phones to be more than ~15 seconds off at the most, and that only if they handle leap seconds incorrectly. – otus Feb 9 '16 at 10:26
  • Looking at our logs I see deltas of even 2 minutes! Actually some older phones don't have automatic time synchronization feature. Some may have turned it off. Of course it becomes an issue of informing users, since we can't allow indefinite windows – Konstantin Feb 9 '16 at 13:09
2

There isn't an industry standard on this that I'm aware of. It's up to your implementation and expected desyncronization. A single minute may still have synchronization problems.

If you set it to 5 minutes (in each direction) that's a total of 20 valid OTPs at any given time (assuming a 30 second expiration). This means that a guess would have a 1 in 50000 chance of being correct, or averaging about 25000 trials before a success. It would be very easy to detect when someone is trying to guess. Because of this, as long as you have a proper password system with rate limiting, 5 minutes should work fine for your case.

  • 6
    Note that the RFC RECOMMENDs against a longer time window than one step. Instead it suggests a "resynchronization" where the validator stores the time drift for users. – otus Feb 9 '16 at 10:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.