Title: Same code does not work in two locations?
Last modified: August 22, 2016

---

# Same code does not work in two locations?

 *  [DrDamnit](https://wordpress.org/support/users/drdamnit/)
 * (@drdamnit)
 * [11 years, 7 months ago](https://wordpress.org/support/topic/same-code-does-not-work-in-two-locations/)
 * I have GA enabled on a site, and it works when I (and another admin) log in, 
   but we are in Eastern Standard Time. My team is in India, and cannot log in.
 * I have send them the QR code we are using, and have confirmed they are using 
   the same secret we are using (using QR Code scanner that reveals the URI that
   contains the key and other information).
 * The only thing I can think of is that either:
    1. They do not have the correct time on their phone
    2. The timezone you’re in makes a difference.
 * Timezone making a difference doesn’t make sense to me since times SHOULD be UTC(
   internally).
 * Has anyone else had this problem?
 * [https://wordpress.org/plugins/google-authenticator/](https://wordpress.org/plugins/google-authenticator/)

Viewing 6 replies - 1 through 6 (of 6 total)

 *  [mbrsolution](https://wordpress.org/support/users/mbrsolution/)
 * (@mbrsolution)
 * [11 years, 7 months ago](https://wordpress.org/support/topic/same-code-does-not-work-in-two-locations/#post-5412641)
 * Hi DrDamnit are you saying that both Admin Users are login in with the same credentials?
 *  Thread Starter [DrDamnit](https://wordpress.org/support/users/drdamnit/)
 * (@drdamnit)
 * [11 years, 7 months ago](https://wordpress.org/support/topic/same-code-does-not-work-in-two-locations/#post-5412694)
 * These guys have their own admin account (different from mine, and our client 
   has the main admin account).
 * Their account has GA enabled, and they have been given the username and password.
 * The username is a normal username (i.e., “StaffAdmin”). And, the password for
   the account is random (like: “E7bOsyyN1JpW”). What they are doesn’t really matter,
   because I know they get hashed and stored in the DB. But, just trying to give
   you a full picture here.
 * As I said before, the GA Secret was verified on their side as the same one I 
   am using. And, they were sent (securely) the QR code that contains the secret
   and GA setup.
 * Via Chat, we discovered that Google Authenticator on their side was, in fact,
   generating different codes than the same code on my side. Here’s who we discovered
   that:
 * Each time the code was generated anew, I put it into our secure chat to send 
   it to them. He compared it on his side, and they were different.
 * If he used a code that I sent him, he was able to log in, so that confirms he’s
   using the correct user pass. The fact that his GA app was generating different
   codes can (in my opinion) only be attributed to the time on his phone being different
   than mine. Which, is what prompted me to post this thread.
 * We really need to get this working because the site we are working with is the
   subject of frequent brute force attacks. The server has fail2ban setup, and we’ve
   been running WordFence, but really want this extra layer of security.
 * I just can’t figure out why the same code on two different phones would generate
   different codes – except if there was a time issue….
 *  [mbrsolution](https://wordpress.org/support/users/mbrsolution/)
 * (@mbrsolution)
 * [11 years, 7 months ago](https://wordpress.org/support/topic/same-code-does-not-work-in-two-locations/#post-5412710)
 * Hi I think the best way to implement this feature in my opinion is to allow them
   to have their own security setup which will produce a different login code in
   their mobile device.
 * I use this plugin on all my websites without a problem and the security plugin
   that I also use in conjunction with this plugin is [All In One WP Security & Firewall](https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/).
   The two plugins build a super protective layer especially if you implement the
   secret login code under Brute Force.
 * The above works for me.
 *  Thread Starter [DrDamnit](https://wordpress.org/support/users/drdamnit/)
 * (@drdamnit)
 * [11 years, 7 months ago](https://wordpress.org/support/topic/same-code-does-not-work-in-two-locations/#post-5412712)
 * I’ll give it a try.
 * But… I disagree:
 * Here’s why:
 * 1. When the other user logs in and generates his own code, that’s not going to
   be any different than if I generated the code and gave him the QR code via screenshot
   as I have done before. Sure, the secret will be different, but the process is
   the same, and the server doesn’t know the difference since this is an out-of-
   band authentication factor. The key here is the secret that is generated.
 * 2. Google Authenticator uses an a one-way hash to turn something (like a time-
   stamp) into the six digit code. Since the secret is the same, the only other 
   thing we can look at is the time-based initialization vector or the input to 
   the hashing algo.
 *  [mbrsolution](https://wordpress.org/support/users/mbrsolution/)
 * (@mbrsolution)
 * [11 years, 7 months ago](https://wordpress.org/support/topic/same-code-does-not-work-in-two-locations/#post-5412714)
 * Hi I understand your point but look at it like this. Everyone that has a Google
   account and implement this security feature will always get a unique code sent
   to their mobile phone. Imagine if you share the same login with two or more people
   around the world by sending them the same code via a screen dump. To me that 
   defies the purpose of **two-factor authentication** security.
 * So everyone that has a Google account will receive a unique code based on a unique
   login which is the best method for security purposes and never share that code
   with anyone. This is how I implement this security feature with all my clients.
 * My humble opinion.
 * Regards
 *  Thread Starter [DrDamnit](https://wordpress.org/support/users/drdamnit/)
 * (@drdamnit)
 * [11 years, 7 months ago](https://wordpress.org/support/topic/same-code-does-not-work-in-two-locations/#post-5412715)
 * This is a good point. But, this isn’t everyone with a google account. It’s a 
   specific account that we have shared with one individual; and as his boss, I 
   keep copies of the codes. So, it’s one person and his superior having access 
   to the account in question.
 * Additionally, having looked up the actual hash that they use, it’s an HMAC that
   measures the number of 30 second intervals since the Unix Epoch. So, it has to
   be a time issue, probably with his phone. This also confirms what I thought: 
   they should be using UTC.
 * The time must be off on their phone…

Viewing 6 replies - 1 through 6 (of 6 total)

The topic ‘Same code does not work in two locations?’ is closed to new replies.

 * ![](https://ps.w.org/google-authenticator/assets/icon-256x256.png?rev=3500822)
 * [Google Authenticator](https://wordpress.org/plugins/google-authenticator/)
 * [Frequently Asked Questions](https://wordpress.org/plugins/google-authenticator/#faq)
 * [Support Threads](https://wordpress.org/support/plugin/google-authenticator/)
 * [Active Topics](https://wordpress.org/support/plugin/google-authenticator/active/)
 * [Unresolved Topics](https://wordpress.org/support/plugin/google-authenticator/unresolved/)
 * [Reviews](https://wordpress.org/support/plugin/google-authenticator/reviews/)

 * 6 replies
 * 2 participants
 * Last reply from: [DrDamnit](https://wordpress.org/support/users/drdamnit/)
 * Last activity: [11 years, 7 months ago](https://wordpress.org/support/topic/same-code-does-not-work-in-two-locations/#post-5412715)
 * Status: not resolved