Forum Discussion
Former Member
4 years ago@sttseng Yes, the passcode generator hashes the local device time with the TOTP secret to generate the 6 digit passcodes. If it asked the internet for the time then this could be manipulated by attackers to generate codes that they could use at a later time.