Web Development
Bug Report
Some users' two-factor codes always failed: server clock drift in one container broke TOTP
A small share of users reported that their authenticator codes were rejected, but only sometimes. One application server's clock ran 70 seconds behind, so codes failed whenever a login reached it. How we found it, fixed time sync, and kept a tight verification window with replay protection.