Wrong OTP on some 1Password versions

gronstrand

Hi,

I am not sure if this is the right topic to post this in, as it seems that multiple versions 1Password are affected. I tried to search and see if someone had reported something similar, but couldn't find anything.

Some 1Password versions has started to give me invalid one-time passwords, even though they use the same secret. Here's what I've found:

1Password X: Wrong OTP
1Password Windows: Wrong OTP (same as X)
1Password Android: Correct OTP (same as Authy/Google Authenticator)

I have not tried this on OSX/iPhone as I do not have a device available.
The behavior is the same for all my accounts with 2FA. I have also tried reinstalling/updating both of the versions that show the wrong password.

I appreciate any help, as this prevents me from using 1Password on my computer without my phone! 8-)

---

1Password Version: Windows 7.2.576 / Android 6.8
Extension Version: 1Password X 1.10.0
OS Version: Windows 10
Sync Type: 1Password.com Account

Mitch

Hi @gronstrand,

Thanks for this report. We're working to standardize OTP generation across our different apps, so your help here should be quite helpful.

In 1Password for Windows, can you click Edit on the item and look at the otpauth:/ URL? I'd like to know a few of the parameters (not all of them will necessarily be present in the URL):

• ?algorithm
• ?digits
• ?counter
• ?period

Of course, please take care not to share any personal information or the TOTP secret itself. I look forward to your response.

Cheers,
Mitch

gronstrand

I'm sorry, it seems to work on all my devices now. Could it have been something on my PC that affected the OTP generation?

AGAlumB

@gronstrand: Defnitely. TOTP is a fairly "simple" technology (no insult intended — it's great because of that) in that it really only involves three elements: the TOTP algorithm used to generate the codes, the TOTP secret which is unique to you, and the current time. The last one is really the only variable, and if your device has system date/time/zone setting that is different from the others, it will generate different codes as a result. It's a bigger problem on systems where it's misconfigured or faulty, but in your case I suspect you just have a little drift and it was addressed by an NTP sync after you first reported this. Anyway, glad it's working for you now. :)

rennarda

I was also seeing this issue with the Mac version, whereas the iOS version worked correctly.

Turns out the time server I was using to set my Mac clock was running 2 minutes fast, so all the one time passwords generated were wrong! Changing to a working time server has fixed the issue

rennarda

(double post)

beyer

@rennarda: Great! I'm glad to hear switching to a different network time protocol server has started generating accurate one-time passwords. Although it's not the same everywhere, most online services don't accept one-time passwords generated by clients that off by more than 60 seconds.

Have a great week and thanks for using 1Password!

-Beyer

oskerlau

I had the same issue, fixed now after adjusting the system time.

AGAlumB

Great! I find I have this problem more on Wi-Fi-only devices, and I can't always count on the automatic time sync to stay up to date (har har) constantly, but setting the system time manually works. Cheers! :)