google-authenticator

Sounds like you need to contact the vendor that supplies your 2FA since it is misconfigured/incorrectly implemented. I've seen this before with people who try to roll their own Google Authenticator/TOTP implementation. What they do is they read the standard, note the 30 second default step size, and entirely ignore the window. If you look at Google Authenticator while the steps are 30 seconds, the window is +1 or -1, so you can enter three different valid codes at any one time (for three different steps: 0, +30, -30). But don't take my word for it, Google has Authenicator source code available here: https://github.com/google/google-authenticator/blob/master/l... Look at "window" or "window_size" options. To quote Google's own comment: > By default, tokens are good for 30 seconds and in order to compensate for possible time-skew between th

Google also created a PAM module for OTP [1]. [1] https://github.com/google/google-authenticator

> Not seconds, usually a minute: Almost every service I use is 30 seconds - including Google's [1]. Even in the RFC you linked it says 30 seconds. > This is mandated because the user could start typing at the end of a time step and/or clocks can be slightly out of sync. That is the downside of TOTP. If your clock isn't in sync with the server's then you may never have a valid OTP. However, I have seen many implementations allow for time shifting - ie the code that was generated in the past 30 seconds, this 30 seconds and the next 30 seconds are all valid. I didn't do that for my source code hosting service - but it makes sense in case the user hit enter right after the 30 second window. I suppose HOTP is supposed to solve the timing problem. > That does not change the fact that TOTP is extremely vulnerable to phishing. This doesn't make s

An open source one at that! https://github.com/google/google-authenticator/