undefined | Better HN

0 pointsJimDabell5y ago0 comments

If you haven’t already, check the time / date / timezone on the device that is generating the codes. Facebook uses TOTP for this, which is time-based. If the time on your device is wrong, the codes will be wrong. I would expect this problem to pop up more frequently this time of year due to errors relating to daylight saving time.

0 comments

7 comments · 3 top-level

justinclift5y ago· 2 in thread

> check the time / date / timezone on the device that is generating the codes.

Sounds like that'd be on the FB infrastructure side though?

remus5y ago

The clocks on both devices (i.e. fb's server and your phone) need to be fairly closely synchronised. TOTP effectively encrypts a timestamp using a shared secret then decrypts it on the other side and checks you're within some bound. If either clock is out it won't work.

ncallaway5y ago

TOTP generates the codes on both the client and server sides. The user enters the client generated code and the server validates it.

So if the time on the client device is wrong (perhaps it was manually set and not updated for daylight savings), then the server will disagree with what the code should be.

kokx5y ago· 2 in thread

DST has nothing to do with TOTP. The TOTP spec specifies that unix time has to be used as the time source, which does not have DST.

JimDabellOP5y ago

That doesn't matter, DST-related events can still break TOTP.

Example: Device is set to the wrong timezone. It’s nearby, but the difference between the two timezones is that one has DST and one doesn’t. DST comes along, either the time changes by an hour when it isn’t supposed to, or it doesn’t change when it is supposed to. The most visible thing that looks broken to the user is not the timezone, but the time. So they adjust the time. The user-visible clock is now “correct” for the next six months as far as the user sees, but the system clock – including UNIX timestamps – is incorrect by an hour. This results in broken TOTP.

kokx5y ago

I find this awfully thin. About every device that does TOTP by default takes its time from the network provider, and lets the user set the correct timezone, and makes it even really easy to do so. Since most DST settings for timezones in the world are quite predictable (yes I am aware that there are few that have last-minute changes, but most don't, especially not in developed nations), most people never have to adjust their timezone because of DST.

Though I do suspect that Google Authenticator even has some logic to reduce these problems, since you can "sync" its time in the settings.

1 more reply

hnick5y ago

It's the FB app on a new iPhone, set to Sydney where we live. There are no DST options I assume "it just works" covers all that.

There is an option to resync inside the FB app, which refreshes and... doesn't change a thing.

Your advice is appareciated though and I'll keep it in mind for the future.

Back to my original comment though. Want support? Maybe you will go to https://www.facebook.com/business/help and read the part that says "Find answers or contact support" and click the button.

This brings up an overlay with the usual SaaS buffet of simple answers for simple questions and not too much else. Click on one, don't find your answer, but wait! There is a message under it!

"Need more help? Contact support."

Yet no link. No button. Just dead text.

This is how multi-billion dollar companies operate in the 21st century.

j / k navigate · click thread line to collapse