[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fIPjZdZHzMxXoXyZqd9K2Q5R0D4-wyIunqRkRCZp5-c4":3},{"item":4,"related":47},{"id":5,"type":6,"title":7,"slug":8,"summary":9,"body":10,"coverUrl":11,"productScreenshots":12,"productLinks":13,"authorName":14,"authorUrl":15,"authorSubject":16,"category":17,"tags":22,"sourceLabel":35,"sourceName":36,"sourceUrl":37,"status":38,"seoTitle":39,"seoDescription":40,"canonicalUrl":41,"isFeatured":42,"sno":43,"sortOrder":44,"publishedAt":45,"updatedAt":46,"createdAt":46},"ece32fc0-f61e-4696-bf85-2eca8dfa230e","article","六位数验证码为什么会自己变化？TOTP 的时间密码","totp-time-based-one-time-password","身份验证器里的验证码不是服务器不断发来的短信，而是手机和服务器根据共享秘密与当前时间独立计算出的短期密码。本文解释 TOTP 的工作方式和换机注意事项。","身份验证器里的六位数验证码通常每隔几十秒就会变化。它看起来像一串随机数字，实际上并不是服务器临时发来的短信，而是手机和服务器根据同一份秘密信息、同一个时间窗口，各自计算出相同结果。这类机制叫 TOTP：基于时间的一次性密码。\n\n## 手机和服务器并不是一直互相发消息\n\n绑定身份验证器时，服务通常会给手机一份共享秘密，常见形式是二维码或一串字符。之后，手机根据当前 Unix 时间把时间切成固定长度的窗口，再用共享秘密计算一个 HMAC 值，最后截取其中一部分变成六位或八位数字。服务器用同样的秘密和时间计算，如果结果一致，就接受这次验证。\n\n```mermaid\nflowchart LR\n    A[共享秘密] --> C[身份验证器]\n    A --> D[登录服务器]\n    B[当前时间] --> C\n    B --> D\n    C --> E[生成一次性代码]\n    D --> F[计算预期代码]\n    E --> G{两者一致?}\n    F --> G\n    G -->|是| H[通过验证]\n    G -->|否| I[拒绝或等待下一窗口]\n```\n\n## 为什么时间不准也可能成功\n\n现实设备的时钟不一定完全一致，服务器通常会允许当前时间窗口前后的一小段偏差。例如，手机显示的代码刚刚跨过 30 秒边界，服务器可能仍会检查相邻窗口，避免用户因为网络延迟或系统时钟轻微漂移而频繁失败。但允许的窗口不能无限扩大，否则旧代码的有效时间变长，攻击者尝试的机会也会增加。\n\nRFC 6238 把时间步长、共享秘密、哈希算法和校时要求写成了可互操作的规范。默认时间步长常见为 30 秒，但具体服务也可以使用不同设置。所谓“代码过期”，本质上是当前时间已经进入了另一个计算窗口。\n\n## 一次性到底体现在哪里\n\n同一个时间窗口内，手机可能显示相同的数字，但服务器通常不应让成功使用过的代码被重复接受。一次性更多体现为服务端的验证策略，而不是数字在屏幕上每秒都变化。\n\nTOTP 也不是抗钓鱼认证。仿冒网站可以在你输入验证码后，立刻把它转发给真实网站，只要代码还在有效窗口内，攻击者就可能完成登录。因此，身份验证器比短信更稳妥，却仍然不如和域名绑定的 Passkey 或安全密钥。\n\n## 换手机时要注意什么\n\n验证器里的共享秘密如果没有迁移或备份，换手机后可能无法生成正确代码。设置 MFA 时应同时保存官方提供的恢复代码，并确认账号还有至少一种可用的恢复方式。恢复代码本身相当于高权限钥匙，不应截图后长期放在公开相册或聊天记录里。\n\n六位数验证码并不神秘：它是一个让手机和服务器在没有持续通信的情况下，对“同一时间、同一秘密”达成短暂共识的算法。\n\n来源：[IETF RFC 6238：TOTP](https:\u002F\u002Fdatatracker.ietf.org\u002Fdoc\u002Frfc6238\u002F)","\u002Fuploads\u002F2026-09-12\u002F3f0420d9-5793-4424-a196-45646f779612.jpg",[],[],"Foundit","https:\u002F\u002Ffoundit.cn","foundit-ai-editorial",{"id":18,"name":19,"slug":20,"description":21},"6179d3b6-dc34-4483-9ded-3cd9f1b37a47","科普","abbreviation","介绍各领域新兴概念",[23,27,31],{"id":24,"name":25,"slug":26},"7c76bfc2-f80f-4ee0-a95d-27bd8708b434","技术","slug",{"id":28,"name":29,"slug":30},"7da20200-5815-42a5-851a-bc8c1db554cb","应用","app",{"id":32,"name":33,"slug":34},"4c2bbea6-eab7-40a8-8447-1de478ff7749","分析","analyse","IETF RFC 6238","TOTP: Time-Based One-Time Password Algorithm","https:\u002F\u002Fdatatracker.ietf.org\u002Fdoc\u002Frfc6238\u002F","published","TOTP 是什么：六位数身份验证码为什么会变化","解释身份验证器如何利用共享秘密和时间窗口生成一次性验证码，以及它与短信验证和 Passkey 的区别。",null,false,58,0,"2026-09-12T00:00:00.000Z","2026-09-12T04:45:42.545Z",[48,56,64],{"id":49,"type":6,"title":50,"slug":51,"summary":52,"coverUrl":53,"authorName":14,"sno":54,"publishedAt":45,"createdAt":55},"8100557d-c909-40e7-9ecf-6ab5f0edd282","为什么二维码破了还能扫出来？二维码的纠错秘密","qr-code-error-correction-explained","二维码不仅能编码网址和数字，还加入了定位图案与纠错信息。本文解释二维码为什么能容忍污渍和破损，以及为什么能扫出来不代表链接一定安全。","\u002Fuploads\u002F2026-09-12\u002F46fd6845-ccdf-41db-a5c7-4daf90c73dd7.jpg",42,"2026-09-12T04:45:41.285Z",{"id":57,"type":6,"title":58,"slug":59,"summary":60,"coverUrl":61,"authorName":14,"sno":62,"publishedAt":45,"createdAt":63},"d759c4f9-5f20-411c-917a-1566681d239a","App 为什么总要申请定位权限？精确、模糊和后台定位","app-location-permissions-precise-approximate-background","定位权限不只是允许或拒绝，还包括精确程度、使用时间和是否允许后台访问。本文帮助普通用户判断不同 App 到底需要哪一种定位权限。","\u002Fuploads\u002F2026-09-12\u002F03e47360-587e-43af-91e1-fdae88fe85f8.jpg",46,"2026-09-12T04:45:44.921Z",{"id":65,"type":6,"title":66,"slug":67,"summary":68,"coverUrl":69,"authorName":14,"sno":70,"publishedAt":45,"createdAt":71},"d8cd5ddb-84fe-406c-9e2d-49a74aa73aed","网站为什么越来越少让你拼图验证“我是人”","captcha-turnstile-how-human-verification-works","新一代人机验证会在浏览器后台运行挑战并生成短期令牌，再由网站服务器确认结果。本文解释它为什么减少交互、如何防止重放，以及它的误判边界。","\u002Fuploads\u002F2026-09-12\u002F6d69d6f0-e936-4c53-92e2-3412dd3fde18.jpg",44,"2026-09-12T04:45:49.580Z"]