Post

Daniel Bayley 🇺🇦

@danielbayley.dev

OTP always be like 4s remaining, just enough to have to wait every single time.

7/10/25, 3:13 pm0 reposts0 likes

Emmie Päivärinta

@about1em.bsky.social

8 Oct 2025

People don't know this, but TOTP usually allow you to use the previous/next OTP to account for clock skew etc.

Daniel Bayley 🇺🇦

@danielbayley.dev

8 Oct 2025

Ha yeah I suspected there might be some overlap accounted for, but not exactly sure how long, and thought it an incredibly tedious experiment to find out… You’re saying an entire 30s either side?

Emmie Päivärinta

@about1em.bsky.social

9 Oct 2025

It's recommended in the spec, but I don't think there's a fixed value, it's up to the implementation www.rfc-editor.org/rfc/rfc6238....

rfc-editor.orgRFC 6238: TOTP: Time-Based One-Time Password Algorithm