We are using Time-based One-time Password Algorithm (Google Authenticator) in our system. Since we currently don't allow any time window and code validity is just 30 seconds, we are constantly having issues with time de-synchronization on devices, which generate TOTP codes. That means that users can't login because they enter codes which are either expired or ahead of time.
It seems like it's a general practice to allow "windows", so system would allow codes which are valid at a time, which is close to precise current time. The question is - how long such windows should be? Is there some industry-wide practice? I'm looking at a generally-accepted value, which is practical, given how precise the time usually is on most phones with Google Authenticator and also is secure-enough. Is it 1 or 5 minutes or something else?