Hacker News Reader

For me it’s “I swear I feel like I’ve gotten the exact same TOTP code not that long ago!”.

What’s the actual likelihood of seeing the same TOTP code from different apps at different times?

What about those ones that get sent out in phone messages?

> What’s the actual likelihood of seeing the same TOTP code from different apps at different times?

There’s only a million 6 digit TOTP codes, so I reckon you get to 50% odds of collision at ~1200 values.

For those curious on how to find that ~1200 values are needed before a 50% probability of collision, this is a generalized form of the birthday problem [0].

With a calculator [1], we can find the exact amount. plugging in D=10^6 (# of unique codes) with P=0.5 (odds of collision) gives you 1178 values.

[0] https://en.wikipedia.org/wiki/Birthday_problem

[1] https://www.bdayprob.com/

The very rough rule of thumb that I think one should remember is: You get a 50% chance of collision with sqrt(total) samples.

Sqrt(1 000 000) = 1 000, close enough to the exact number you calculated.

More accurately, for 50% it's \sqrt(\ln(4))\sqrt(N) which is \sqrt( ln(4) N ).

That's about 1.17741 times \sqrt(N).

The reasons are explained here: https://news.ycombinator.com/item?id=40886363

Reply on news.ycombinator.com