0

I have noticed that a certain website, which uses sms as two factor authentication service, occasionally sends me the same 2fa code twice if the first attempt to login fails and I try again quickly.

I have never seen that behavior before and was wondering whether that's okay.

2
  • "okay" is subjective ... could you provide more info on what issues you are worried might arise from this behavior? Jul 15, 2022 at 15:48
  • @CaffeineAddiction I don't know, it just seemed very odd
    – DonQuiKong
    Jul 15, 2022 at 18:13

1 Answer 1

3

They might be using Time-based OTP (TOTP - https://www.rfc-editor.org/rfc/rfc6238), where OTP changes after set amount of time (e.g. 30 seconds). So if you try to get second OTP quickly enough, you actually can get the same OTP code.

For example if the same OTP code is valid from 15:00:00 to 15:00:30 and you try to get OTP code at 15:00:08 and second one at 15:00:27, OTP will be the same.

This is quite common and OK.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .