Security Token Issue - Not 56k Friendly

[Zumi]

Update on a test

Used a Token to get password at 12:45, try to log in at 1:22, I could not log in.
10 min = still can log in
37 min = can not log in

More testing is needed to figure out how long these passwords stay active for. I am done testing this for today getting tired.

[Darwinion]

Update on a test

Used a Token to get password at 12:45, try to log in at 1:22, I could not log in.
10 min = still can log in
37 min = can not log in

More testing is needed to figure out how long these passwords stay active for. I am done testing this for today getting tired.

Well that's useful info anyway. I think 10 mins is too long really. Shouldn't really be any more than 1 or 2 mins.

[shaddix]

I'm not having this problem. This is what I did:

Generated 4 passwords:
123456
234567
345678
456789

Logged in with 456789.

Generated another password: 567890

Logged in with 567890.

All of the passwords I generated before did not work. I will try just doing 1, then trying an old one a little later.
All of that was done within a 5 minute period.

[shaddix]

If I generate two, login using the later one, wait a minute then try logging in with the previous one it fails. My experience is that it is deactivating anything older than the last one you used to log in.

I will try generating several, recording the times, logging in with each older going to newer with different differences in time of generating>login

[shaddix]

edit: deleted all that other shit because it no longer applies

Okay password recorded at 3:53:44 central, logged in at 4:18:44 central. - 25 minutes - successful login.

[Mariote]

anyone knows if i link 2 pol id's in my token, i can connect 2 accounts simultaneously? and if i desactivate the token, can still log 2 accounts at same time that share same SE passw? :S

[shaddix]

27 minutes appears to be the cutoff. I was denied login at 28 and 27, but successful just before 27 and successful at 26.

Also it seems the passwords generate every 40 seconds or something? Its not as short as 30 I don't think. Kind of hard to figure out.

So 40 possible combinations will be working at any given time unless you've recently logged in and nullified the 39 previous ones I suppose. Probably gives a little leeway and allows ones that will be generated next to work as well. Though 27 minutes seems excessive, do they really expect the clocks on these things to get off by 27 whole minutes? It's probably 27 minutes into the future as well.

Actually maybe its 30 minute window in both directions from SE's clock. And mine is already 3 minutes behind? Or maybe the cutoff is 20 minutes and my token is 7 minutes fast?

[Ruuz]

I made a thread in Advanced. Hopefully that'll get enough attention that SE will fix it haha.

LOL, I think advanced section (much less BG as a whole) is the last place SE looks for input. ^^

[Day]

I think you'd be surprised. ^^

[Araelus]

I think you'd be surprised. ^^

http://img12.imageshack.us/img12/8715/img0183copy.jpg

The Sage agrees with Day.

[Suited Aces]

anyone knows if i link 2 pol id's in my token, i can connect 2 accounts simultaneously? and if i desactivate the token, can still log 2 accounts at same time that share same SE passw? :S

I can confirm that you can have 2 separate IDs using the same token/SE account and have them both logged in at the same time. No idea about the deactivating part.

[cdgreg]

So once you've been logged in for 30 minutes and the security token is blank is it still creating possible PWs, or not until you press the button?

[bungiefan]

The passwords are generated by a function of time. The server can't tell when you press the button, it just knows the formula used to make the code and can verify that it's valid. The point of the token is that the token knows the math, you don't. There are always valid passwords being generated about every 30 seconds, you just don't see them until you have the token run the math.