Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iOS 9 Time bug breaking two factor authentication

news.ycombinator.com

Post reply on HN
Print view View original

1–10 of 10 posts

iOS 9 Time bug breaking two factor authentication

#1

Post by jpp123 »

The iOS 9 clock issue previously discussed (see https://news.ycombinator.com/item?id=10262244) is a lot worse than originally indicated.

Our devops team are seeing users who can no longer authenticate using 2FA code generators because their phones are off by over 30 seconds. The offset seems fairly random - a quick poll in our office shows that it appears to only impact iOS9. Mine is off 3.7 seconds. The biggest offset I've seen is 41 seconds.

Reboots, setting manually and the n going back to auto etc don't fid it.

You can check your offset at http://time.is or by downloading the free Emerald Time ntp app.

Any suggestions for a workaround greatly appriciated.

Re: iOS 9 Time bug breaking two factor authentication

#2

Post by Someone1234 »

Sounds like you need to contact the vendor that supplies your 2FA since it is misconfigured/incorrectly implemented.

I've seen this before with people who try to roll their own Google Authenticator/TOTP implementation.

What they do is they read the standard, note the 30 second default step size, and entirely ignore the window. If you look at Google Authenticator while the steps are 30 seconds, the window is +1 or -1, so you can enter three different valid codes at any one time (for three different steps: 0, +30, -30).

But don't take my word for it, Google has Authenicator source code available here:

https://github.com/google/google-authenticator/blob/master/l...

Look at "window" or "window_size" options. To quote Google's own comment:

> By default, tokens are good for 30 seconds and in order to compensate for possible time-skew between the client and the server, we allow an extra token before and after the current time. If you experience problems with poor time synchronization, you can increase the window from its default size of 1:30min to about 4min. Do you want to do so

So as I said, your 2FA is incorrectly done.

Re: iOS 9 Time bug breaking two factor authentication

#3

Post by jpp123 »

Someone1234 wrote: post #2

Sounds like you need to contact the vendor that supplies your 2FA since it is misconfigured/incorrectly implemented. I've seen this before with people who try to roll their own Google Authenticator/TOTP implementation. What they do is they read the standard, note the 30 second default step size, and entirely ignore the window. If you look at Google Authenticator while the steps are 30 seconds, the window is +1 or -1,…

I'm not going to publicly shame the vendor we use, but yes we've had words.

Re: iOS 9 Time bug breaking two factor authentication

#6

Post by joezydeco »

Someone1234 wrote: post #2

Sounds like you need to contact the vendor that supplies your 2FA since it is misconfigured/incorrectly implemented. I've seen this before with people who try to roll their own Google Authenticator/TOTP implementation. What they do is they read the standard, note the 30 second default step size, and entirely ignore the window. If you look at Google Authenticator while the steps are 30 seconds, the window is +1 or -1,…

So are you saying Google Authenticator will be useless when my clock is >60 seconds out of sync? Or do they record my last interaction and note the time delta from there?

Re: iOS 9 Time bug breaking two factor authentication

#7

Post by jpp123 »

jgeorge wrote: post #4

My iPhone clock is 2 minutes fast. My project is with network timing, so I'm acutely aware of clocks being off, and its driving me crazy.

9.0.2 fixes it - or buy an Apple watch because that appears to mitigate it (speculation the Apple QA team all have an Apple Watch :-)

Re: iOS 9 Time bug breaking two factor authentication

#10

Post by jgeorge »

jpp123 wrote: post #7
jgeorge wrote: post #4

My iPhone clock is 2 minutes fast. My project is with network timing, so I'm acutely aware of clocks being off, and its driving me crazy.

9.0.2 fixes it - or buy an Apple watch because that appears to mitigate it (speculation the Apple QA team all have an Apple Watch :-)

9.0.2 does indeed fix it. I don't have a watch; I almost electrocuted myself a number of years ago wearing a watch with a metal band, so I don't wear one anymore. :)
Post reply on HN