Hacker News Reader

> TOTP systems are supposed to implement a sliding window to account for reasonable clock differences, usually within 5 minutes.

The default is 30 seconds, as per the RFC: https://datatracker.ietf.org/doc/html/rfc6238

(not sure that meaningfully changes what you were saying, but just fyi.)

View on HN

30 seconds is the default “time step” (4.2), but in talking about the transmission delay window (5.2), which the RFC recommends “at most 1 time step”, but also says that validation should occur for both the previous and next time step window. However in practical implementations, 5 minutes on both sides is typically used.

Reply on news.ycombinator.com