Its a shame the TOTP standard does nor support variable code length, 8 symbols seems to be better for high value accounts but still usable
It does. TOTP (RFC 6238) builds off of HOTP (RFC 4226), which states (§5.3):
Implementations MUST extract a 6-digit code at a minimum and possibly 7 and 8-digit code. Depending on security requirements, Digit = 7 or more SHOULD be considered in order to extract a longer HOTP value.
There is no inherent limitation in the protocol on how many digits to use (AFAICT): the pseudo-code examples have the number of digitals desired as a parameter in each function.
Further, HOTP even discusses (§E.2) is to use (six+) alphanumeric characters ([A-Za-z0-9]) instead of just digits ([0-9]), though digits are "desirable" for easier entry.
True, but the problem is I do not believe any apps implementing TOTP allow for codes over six numerical digits. So the real world standard (Google Authenticator) does not support it.
Comments
It does. TOTP (RFC 6238) builds off of HOTP (RFC 4226), which states (§5.3):
* https://datatracker.ietf.org/doc/html/rfc4226#section-5.3
There is no inherent limitation in the protocol on how many digits to use (AFAICT): the pseudo-code examples have the number of digitals desired as a parameter in each function.
Further, HOTP even discusses (§E.2) is to use (six+) alphanumeric characters ([A-Za-z0-9]) instead of just digits ([0-9]), though digits are "desirable" for easier entry.
True, but the problem is I do not believe any apps implementing TOTP allow for codes over six numerical digits. So the real world standard (Google Authenticator) does not support it.
Google supports 6 or 8, [Aegis](https://getaegis.app/) supports the full standard, Authy supports 6 or 8, Sophos supports 6 or 8. Lots of support.