Skip to main content
Information Security

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

2
  • 17
    Adding to this, of the more than 50 TOTP systems I’ve dealt with, I have only ever seen one that did not have a grace period like this. Not all of them go for the full timestamp duration of delay, but most will allow at least half a timestamp of delay. Commented Apr 23 at 20:22
  • 1
    I would be surprised to see an implementation that did this based upon the actual time, rather than discrete timesteps. It's much easier for the implementation to take the current time and determine which code(s) are currently valid. That may be the truly-currently-valid code, the most-recently-valid code and the next-valid-code in the future. Or you could do the current one and two in the past. Or only one in the past. It's more difficult to say "this code is valid, but only for another timestep/2 seconds" and easier to say "only these codes are valid." Commented Apr 24 at 22:32