system
Given the following post, respond as if you're commenting on Reddit:
human
Are 2FA codes random or is there an algorithm in place to make the digits more human-friendly?

Hey, 

At my work, as in most tech companies, we use the security tokens to log into certain systems as a 2-FA.

For those who don't know, it's a little device that displays a 6-digit code that changes every 30 seconds and you use it to log into work-related systems. Some sites use your phone for this, steam for example. Others use google authenticator that also has 6 digits. 

&#x200B;

My question is since these codes need to be input manually, are they more human-friendly or indeed, completely random? 

I have noticed on the security token I use for work, since I use it way more often than any other 2FA, that often the code is somewhat easy to remember. Often you get codes like "556 789" or "222 001". Digits repeat, follow one another (478), are close on the keyboard (369) or "skip" (727 545). 

&#x200B;

Is it normal practice to incorporate some kind of algorithm into these code generators to make it easier for humans to copy them or are they completely random and my confirmation bias is only remembering the "good" combinations?

&#x200B;

Thanks.
gpt
The codes don't have a discernible pattern in them. While you may not technically be able to call them random, effectively that's what they are.

2FA systems that produce a new code every 30 seconds are part of a system called "Time-based One-Time Passwords" or TOTP. TOTP works by combining 2 elements to generate the code: First is a shared secret key that is present in both the authentication device (which can be a separate device or a smartphone app) and on the server. This secret key is unique for each user. The second component is the time. Typically measured in 30 second intervals.

When you press the button on the device or open the smartphone app, the code is computed by taking both the secret key and the time and running them through a certain mathematical function called a "cryptographic hash function". A cryptographic hash function is a function that can take any number or data as input and outputs a number in such a way that it is impossible to reverse the process and figure out what the input was for a given output. With a good hash function, no matter how many outputs you collect, you should not be able to deduce or brute force what the input was, even if you have some partial information about it, for example that the outputs are TOTP codes that belong to consecutive time-steps.

So when you try to use this system to authenticate, both the device and the server use the shared secret key and the current time to compute the code. You then input the code and the server can verify that it is the same as what it has computed. If it is, then that proves that you possess the shared secret key. The secret key is crucial in this process. If an attacker obtains it, he will be able to perfectly reconstruct the authentication codes.

Since time is a variable in the algorithm, it is important for both parties to have a clock that is synchronized. Unfortunately, clock synchronization is not something that is easy to do between devices that aren't directly connected. So to compensate for this issue, the server may allow for not just the current code to be accepted, but also codes corresponding to one or more 30 second steps backwards or forwards. If the server detects that a user is having a clock that deviates slightly, it could store this offset in the user's profile and use that information in the future. This would allow users with a clock that is gradually drifting further away from the actual time to still use the system. As long as the clock drift between two logins isn't too big, the server can accept it and keep track of it.

The algorithm used for TOTP doesn't care about what digits come out on the other end. There is no bias towards combinations that are easier to enter and the fact that you're remembering the codes that do appear to have a pattern is simply because those are the codes that are the most memorable.