WEBVTT

00:00:00.150 --> 00:00:01.067
Internet off.

00:00:01.067 --> 00:00:03.067
Flight mode on.

00:00:03.067 --> 00:00:03.917
Still a new code every

00:00:03.917 --> 00:00:05.300
30 seconds.

00:00:05.450 --> 00:00:06.767
Where does it come from?

00:00:06.767 --> 00:00:08.517
Nobody sends it.

00:00:08.667 --> 00:00:11.283
Google Authenticator:

00:00:11.283 --> 00:00:14.050
100 million+ downloads

00:00:14.200 --> 00:00:15.650
These 6 digits

00:00:15.650 --> 00:00:17.533
are your second key

00:00:17.683 --> 00:00:18.950
And at the end:

00:00:18.950 --> 00:00:20.467
the one mistake that breaks

00:00:20.467 --> 00:00:22.100
every code

00:00:22.250 --> 00:00:23.333
So how,

00:00:23.333 --> 00:00:24.500
without internet?

00:00:24.500 --> 00:00:26.267
Two things.

00:00:26.417 --> 00:00:29.050
One: a secret,

00:00:29.050 --> 00:00:30.733
given to you once

00:00:30.883 --> 00:00:32.383
Remember the QR code you

00:00:32.383 --> 00:00:34.100
scanned at setup?

00:00:34.250 --> 00:00:35.450
Inside it:

00:00:35.450 --> 00:00:37.450
a long secret key

00:00:37.600 --> 00:00:38.833
One copy to your phone,

00:00:38.833 --> 00:00:40.150
the same copy

00:00:40.150 --> 00:00:41.767
to the server

00:00:41.767 --> 00:00:43.583
After that,

00:00:43.583 --> 00:00:45.533
they never talk again

00:00:45.683 --> 00:00:47.967
Two: time,

00:00:47.967 --> 00:00:49.450
which both of them have

00:00:49.600 --> 00:00:51.367
Computers count seconds since 1

00:00:51.367 --> 00:00:54.017
Jan 1970

00:00:54.167 --> 00:00:55.650
Divide by 30,

00:00:55.650 --> 00:00:58.333
and you get a counter

00:00:58.483 --> 00:01:00.733
It ticks up every 30

00:01:00.733 --> 00:01:03.383
seconds, on both sides

00:01:03.533 --> 00:01:05.567
The trick:

00:01:05.567 --> 00:01:06.983
secret + counter go into

00:01:06.983 --> 00:01:08.417
a blender

00:01:08.567 --> 00:01:11.500
Out comes a jumble

00:01:11.500 --> 00:01:14.183
of 40 characters

00:01:14.333 --> 00:01:15.333
Turning it back into

00:01:15.333 --> 00:01:16.767
the secret:

00:01:16.767 --> 00:01:18.250
nearly impossible

00:01:18.400 --> 00:01:20.350
4 bytes are picked,

00:01:20.350 --> 00:01:22.733
making one big number

00:01:22.883 --> 00:01:24.550
Its last 6 digits:

00:01:24.550 --> 00:01:26.900
that's your code

00:01:27.050 --> 00:01:28.933
Now listen:

00:01:28.933 --> 00:01:30.883
the server does the same math

00:01:31.033 --> 00:01:32.550
Same secret,

00:01:32.550 --> 00:01:33.667
same counter,

00:01:33.667 --> 00:01:35.300
same code

00:01:35.450 --> 00:01:36.267
You type it.

00:01:36.267 --> 00:01:37.300
They match.

00:01:37.300 --> 00:01:39.133
You're in.

00:01:39.283 --> 00:01:40.833
The code was never sent;

00:01:40.833 --> 00:01:43.067
both made it

00:01:43.217 --> 00:01:45.433
So no internet needed,

00:01:45.433 --> 00:01:47.050
even in flight mode

00:01:47.050 --> 00:01:48.983
New counter after 30 seconds:

00:01:48.983 --> 00:01:50.650
a whole new code

00:01:50.800 --> 00:01:54.583
Stolen? It's useless in 30 seconds

00:01:54.733 --> 00:01:56.167
Now the mistake:

00:01:56.167 --> 00:01:57.033
what if your phone's time

00:01:57.033 --> 00:01:58.583
is wrong?

00:01:58.733 --> 00:02:00.350
Counters out of step,

00:02:00.350 --> 00:02:02.500
codes don't match

00:02:02.650 --> 00:02:04.017
The server allows a step

00:02:04.017 --> 00:02:05.017
or two,

00:02:05.017 --> 00:02:06.650
no more

00:02:06.800 --> 00:02:08.367
The fix:

00:02:08.367 --> 00:02:09.050
keep your phone's time

00:02:09.050 --> 00:02:10.817
on automatic

00:02:10.967 --> 00:02:12.583
Since April 2023:

00:02:12.583 --> 00:02:14.483
secrets can back up

00:02:14.483 --> 00:02:16.217
to your Google account

00:02:16.367 --> 00:02:17.850
Lost your phone?

00:02:17.850 --> 00:02:18.850
Codes come back

00:02:18.850 --> 00:02:20.067
on the new one

00:02:20.217 --> 00:02:22.200
But at launch,

00:02:22.200 --> 00:02:24.733
it wasn't end-to-end encrypted

00:02:24.883 --> 00:02:26.183
A secret,

00:02:26.183 --> 00:02:27.750
a clock,

00:02:27.750 --> 00:02:29.300
a little math

00:02:29.450 --> 00:02:31.017
SMS OTP or authenticator?

00:02:31.017 --> 00:02:34.333
Tell me below