When will the passcode generated in Duo mobile will be expire?


#1

I found that I could use the passcode which generated several days ago in Duo Mobile as valid passcode to login Duo. Of coz, the code could be use one time only.

I would like to know when will it be expire? never?

If so, user could write down a long list of the generated passcode to login Duo?

Or I missed some setup option in Duo admin panel?

Thanks.


#2

Hi there. Per this knowledge base article, https://help.duo.com/s/article/2107, it depends on whether it’s an HOTP or TOTP passcode. For the HOTP passcodes you’re referring to, the passcode is valid until a new passcode is generated in the application.

HOTP (Duo-protected accounts) passcodes are valid until they have been used. If a second passcode is generated and used before the first, then the first becomes invalid. The passcode will remain on display for 60 seconds or until you either generate another passcode or leave the application.


#3

Thanks for your information.

I would like to ask, all Duo mobile generate HOTP (e.g., Android iOS). How about hardware token from Duo?

Thanks.


#4

The information you’re looking for regarding Duo Mobile is linked in the same article above and is true across all mobile platforms. The Duo-branded Vasco Digipass Go6 hardware tokens we offer are also HOTP.

While you can also import your own hardware token, it’s important to note that TOTP token drift and resynchronization are not supported. As a result, imported TOTP tokens may not work for authentication with Duo, or may fail to work for authentication after a variable period of time.

You can find a bunch of links to learn more here: https://help.duo.com/s/article/2112.