I have tested 2FA to be working with server timezone: (UTC) Dublin, Edinburgh, Lisbon, London and device timezone: (UTC +08:00) Kuala Lumpur, Singapore with current datetime. Daylight Saving will end on October 30, 2016 at 2:00 AM and clock will go back 1 hour.
When the server auto adjust the clock, will our device still be able to authenticate? Is it possible to test this capability now before the Daylight Saving end on October 30, 2016 at 2:00 AM?
Yes, your device should still be able to authenticate after the Daylight Saving time change. Most time-based two factor authentication implementations (e.g. Google Authenticator) use the TOTP algorithm defined by RFC 6238. This RFC requires that the T
counter value be time-based:
...the current Unix time (i.e., the number of seconds elapsed since midnight UTC of January 1, 1970) for OTP generation.
Since the T
value is based on UTC timestamps, those timestamps will not be affected by local timezones or by things like Daylight Savings time changes.
Hope this helps!