Wishlist: Better handling of time remaining

[yubico]

Wishlist: Better handling of time remaining

[dainnilsson]

The current behavior is actually very much "by design". As this app requires a physical action (tapping your YubiKey against the phone) to generate new codes, it's not possible to automatically roll over to the next codes once the current ones expire. Since it wouldn't be very useful to display codes that are only valid for a few (say, less than 10) seconds, the app instead chooses to generates codes that strictly speaking may not yet be valid, but are not just about to expire. Servers take into account that device clocks are not perfectly synchronized, and for the time needed for the user to input a code, by allowing for codes which are slightly too old, or even slightly to early, to be accepted. We've opted for a "not-strictly-correct" approach which seems to work very well in practice and gives a consistent and useful user experience with the app. While we haven't seen any problems with this approach, please let us know if you've encountered issues with authenticating that are due to this strategy.

[dainnilsson]

Closing this issue now, but feel free to re-open it if it is causing problems for you.

[mjbnz]

Thank you for the response. That's a fairly elegant way to deal with the intentional design of not automatically cycling to new codes.

However, this has caused me an issue at least once - and only with one site - evernote.com. The others seem to be quite generous as you suggest.

Can I suggest an alternative solution?

• Display the correct 'current' code
• Display the correct remaining time with the bar at the top of the screen
• Roll over once, but only if the time remaining at the time of tap is less than 30% or so.

This assumes that the algorithm for generating codes is contained within the app, and not the key (I am assuming that only the secret key is stored on the yubikey, and it's not a transaction with the app passing a timestamp to the yubikey to have the codes generated and returned?)

Please note that this is not me trying to find a solution for one problematic site (that I barely use anyway), but more to resolve what is to me an ambiguous display of information.

[mjbnz]

Just noticed your comment:

it's not possible to automatically roll over to the next codes once the current ones expire

In which case my suggested alternative is a non-starter anyway. If in fact what happens is the key is passed a timestamp and it returns codes, kudos - that's a really neat way to securely do it and protect the secret keys.

(However, perhaps two timestamps could be passed? keep the second result to display n seconds later 😁 )