Google Authenticator

Question

Android

Gentlemen Khabrozhiteli, today I reconfigured my Gmail for two-step authorization through "Google Authenticator". According to Google, this software does not require an Internet connection or cellular network to generate a password.
Description of work: when the program starts, a generated access code and a timer appear, if the timer has counted, the code becomes invalid, and a new one appears and the timer restarts.
Tests performed: I tested the program in the "Airplane" mode and after restarting the phone in the above mode. It is noticed that the codes continue to be updated even after exiting the program.
Test parameters: I logged in on a PC via Google Chrome, the code is generated on the phone (airplane mode), it is also verified that the code becomes obsolete immediately after the timer ends (with an accuracy of 6 digit dialing speed).

Interested in the question of how it is implemented and what pitfalls I can expect. UPD: one of the RFC

timing options (thanks mifki )

Answer 1

Time wise, obviously, here is the RFC tool.ietf.org/html/rfc6238

Answer 2

I thought about it, but I don't understand this point:
What happens if the clocks of the phone and the server are out of sync?

Answer 3

Pitfall - you will "kill" the application. In this case, you need to do a different type of login, one-time passwords, for example.