How random are TOTP codes?
shkspr.mobi
I'm pretty sure that the 2FA codes generated by my bank's TOTP app have a bias towards the number 8 - because eight is an auspicious number. But is that just my stupid meaty brain noticing patterns where none exist? The TOTP algorithm uses HMAC, which in turn uses SHA-1. My aforementioned brain is not […]
  • Technoguyfication@sh.itjust.works
    11·
    5 months ago

    For anyone who doesn’t read the article, the biases shown in the thumbnail are not the final result. After doing a million runs, every digit had close to the same probability of appearing.

  • RonSijm@programming.dev
    6·
    5 months ago

    Pretty cool to show that sample size matters a lot during testing…

    Sample size = 10: “There’s 20% 8! WTF, should be 10%”
    Sample size = 10k+: “Oh wait nevermind”