Can you log in many times with the same 2FA code by simply manipulating the network time?

I wonder how secure your bitcoins on an online wallet or an exchange are with google 2fa security.

Without 2fa your coins will of course be quickly stolen. It can even be done with 2fa.

But how easy is this to be done?

​

I ask myself when my 2fa codes did not work. I had not used my 2fa phone for a month. It is also not connected to the internet. When I turned on my Wi-Fi, I suddenly saw the time change to the right time. Then my 2fa suddenly also worked normally again.

​

In addition, I now have a few questions about the reliability.

My thoughts about this are that a 2fa is very easy to manupilate.

​

Here are a few points:

* Google authenticator works offline without internet.

* I could not log in with 2fa on the PC because the time was not right on my device.

​

Here are a few points about how I think about it:

* I think if you put the clock back one hour from your 2fa device, you will see the same 2fa codes again.

* If you put the 2fa device an hour later, you will see all the codes that you can normally use after an hour to pair 2fa with your account.

​

A hacker easily taps internet traffic between a PC and a website to steal the confirmation time, username, password and 2fa code. Normally your coins are just safe on the exchange.

​

But how about changing the time settings of your desktop or choosing a different network time zone with a VPN tunnel to choose a country / time zone where it is exactly an hour earlier to log in with the same 2fa code? After that he would still be able to change the time again with the same 2fa code to get the coins from the account?

​

I have not yet examined it myself to check this, but maybe somebody knows that here.

​

I know that the question is not completely bitcoin related. But can certainly be interesting because the theft of bitcoins is a big problem and we all use 2fa for exchanges or wallets. That hope that there are people who know the correct answer or can confirm this of course