How do i get the authenticator to produce 6 digit codes instead of 8?

Matthew Crosby 51

I lost 5 grand this morning because I couldn't log In to get to my bank app because it asked for 6 digits not 8. Now everything is asking for 6. And authenticator. Is only showing 8. How the hell can I abolish this stupid thing so nothing needs more authenticating then password? Remember the good ole days when that wad more than enough. All this dows is prevent you from being able to secure your own property.

Tony Braga 0 Reputation points

2023-06-09T17:20:21.59+00:00

I lost 8 grand this morning because I couldn't log In to get to my bank app because it asked for 6 digits not 8. Now everything is asking for 6. And authenticator. Is only showing 8. How the hell can I abolish this stupid thing so nothing needs more authenticating then password? All this dows is to prevent you from being able to secure your own property.
Mikhail 5 Reputation points

2023-06-14T14:07:43.5766667+00:00

https://support.microsoft.com/en-us/verifyme
hope this one works for you

7 answers

Chris Armstrong 66 Reputation points

2022-10-28T10:26:32.347+00:00
This is what worked for me after countless hours of pulling out hair... when trying to get the MS Authenticator app to give me a 6 digit code on iPhone 14 pro

If you have the account already on MS Authenticator then remove it!

Goto your MS account https://account.microsoft.com/

Scroll down until you find "Security", expand the section and find and click the link "Additional security options".

A little way down the page click the link "Add a new way to sign in or verify".

Select "Use an app" from the popup dialog.

click the link in the body text "set up a different Authenticator app." and you will be presented with a QR code

Open the MS Authenticator app on your phone

click the "+" to add an account, then click "Other (Google, Facebook, etc)

Scan the QR code.

Done!
Please sign in to rate this answer.

13 people found this answer helpful.
LeviH 1 Reputation point

2022-10-31T17:06:29.203+00:00

Works, thank you!!

ravikiran karri 1 Reputation point

2022-12-08T04:31:35.937+00:00

Thank's a Lot ChrisArmtrong... help a lot , A big thank u for ur help....

prem sagar 1 Reputation point

2022-12-21T09:21:01.963+00:00

This worked!!. Thanks a ton.

Jason Gregory 0 Reputation points

2023-01-26T11:04:55.5666667+00:00

THANK YOU!!!! This actually worked!!!!

Abdul Rehman Fayyaz 0 Reputation points

2023-02-22T17:22:13.3466667+00:00

You Saved Me.. Thank you <3

Tom Cannon 5 Reputation points

2023-02-24T17:18:08.22+00:00

I never get the QR in step 5. Any suggestions?

Cloud Yeah 0 Reputation points

2023-02-25T08:15:29.6966667+00:00

Dearest Chris Armstrong, THANK YOU so much!!! Had been lost for hours on this one, tried several apparent solutions offered online but no-one worked. Then, right before reaching the top total frustration level, I was so lucky to find your solution: the ONLY ONE which worked. God bless you!! Very best regards

Andy Fordred 45 Reputation points

2023-06-03T14:02:49.44+00:00

this solved my issue thanks

Rod Beechey 0 Reputation points

2023-06-09T12:30:28.4466667+00:00

Nope not today. The step for "and you will be presented with a QR code" does not exist.

Mads L 0 Reputation points

2023-06-19T16:04:11.94+00:00

Brilliant! Good riddance Authenticator app! The biggest turd ever laid on our green earth!

Katherine 0 Reputation points

2023-08-02T18:30:42.7533333+00:00

Thank you!!

GetteD 0 Reputation points

2023-12-07T22:44:25.8+00:00

This is an amazing fix!!! thank you SO much for sharing!! now i can pay my bills

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Sign in to comment
Sujith Ravindran 5 Reputation points

2023-06-09T11:03:19.0733333+00:00

This is how it worked for me. I use the MFA for logging in to AWS console. After my phone reset, the code that Authenticator showed were always 8 digits instead of the 6 digits the AWS console was requesting. I followed the steps mentioned by Chris Armstrong (Oct 28, 2022, 3:56 PM), but only it helped to create a new account that did provide 6 digit token, but never was in sync with AWS. Even after I tried resync in AWS with 2 tokens, it did not help.

Finally, I logged into to AWS through alternate options like email code + phone call verification, and once inside, I removed the existing MFA option and created a new one. Open the MFA app and scanned the new QR code. Now this new option is setup, and works.

Summary: Once you reset your phone or get a new phone, the authenticator is not in sync with AWS. So you have to get inside AWS through other alternate options and remove the existing MFA option and create a brand new one, and use your newly installed Authenticator app to scan and setup the new account.
Please sign in to rate this answer.

1 person found this answer helpful.

0 comments No comments
Sign in to comment
risolis 8,701 Reputation points

2022-08-01T00:54:24.577+00:00

Hello @Matthew Crosby

Thank you for your heads up.

I would like to assist you on this and i might say that there could be different reasons why that can occurs.... Let me name them below:

-Passwordless authentication is enabled on your account.

-If I am not mistaken, if you do not know or get the normal 6 digits code prompt is because this is asking for your backup code which match the numbers digits code stated by you.

That might be some examples but the main reason this should be 6 digits is for the reason below( Technical explanation):
Please sign in to rate this answer.
risolis 8,701 Reputation points

2022-08-01T00:54:45.14+00:00

Security Considerations

5.1. General

The security and strength of this algorithm depend on the properties
of the underlying building block HOTP, which is a construction based
on HMAC [RFC2104] using SHA-1 as the hash function.

The conclusion of the security analysis detailed in [RFC4226] is
that, for all practical purposes, the outputs of the dynamic
truncation on distinct inputs are uniformly and independently
distributed strings.

The analysis demonstrates that the best possible attack against the
HOTP function is the brute force attack.

As indicated in the algorithm requirement section, keys SHOULD be
chosen at random or using a cryptographically strong pseudorandom
generator properly seeded with a random value.

Keys SHOULD be of the length of the HMAC output to facilitate
interoperability.

We RECOMMEND following the recommendations in [RFC4086] for all
pseudorandom and random number generations. The pseudorandom numbers
used for generating the keys SHOULD successfully pass the randomness
test specified in [CN], or a similar well-recognized test.

All the communications SHOULD take place over a secure channel, e.g.,
Secure Socket Layer/Transport Layer Security (SSL/TLS) [RFC5246] or
IPsec connections [RFC4301].

We also RECOMMEND storing the keys securely in the validation system,
and, more specifically, encrypting them using tamper-resistant
hardware encryption and exposing them only when required: for
example, the key is decrypted when needed to verify an OTP value, and
re-encrypted immediately to limit exposure in the RAM to a short
period of time.

risolis 8,701 Reputation points

2022-08-01T01:09:32.48+00:00

The key store MUST be in a secure area, to avoid, as much as
possible, direct attack on the validation system and secrets
database. Particularly, access to the key material should be limited
to programs and processes required by the validation system only.

An OTP generated within the same time step will be the same. When an
OTP is received at a validation system, it doesn't know a client's
exact timestamp when an OTP was generated. The validation system may
typically use the timestamp when an OTP is received for OTP
comparison. Due to network latency, the gap (as measured by T, that
is, the number of time steps since T0) between the time that the OTP
was generated and the time that the OTP arrives at the receiving
system may be large. The receiving time at the validation system and
the actual OTP generation may not fall within the same time-step
window that produced the same OTP. When an OTP is generated at the
end of a time-step window, the receiving time most likely falls into
the next time-step window. A validation system SHOULD typically set
a policy for an acceptable OTP transmission delay window for
validation. The validation system should compare OTPs not only with
the receiving timestamp but also the past timestamps that are within
the transmission delay. A larger acceptable delay window would
expose a larger window for attacks. We RECOMMEND that at most one
time step is allowed as the network delay.

risolis 8,701 Reputation points

2022-08-01T01:10:03.6+00:00

The time-step size has an impact on both security and usability. A
larger time-step size means a larger validity window for an OTP to be
accepted by a validation system. There are implications for using a
larger time-step size, as follows:

First, a larger time-step size exposes a larger window to attack.
When an OTP is generated and exposed to a third party before it is
consumed, the third party can consume the OTP within the time-step
window.

We RECOMMEND a default time-step size of 30 seconds. This default
value of 30 seconds is selected as a balance between security and
usability.

https://datatracker.ietf.org/doc/html/rfc6238

Matthew Crosby 51 Reputation points

2022-08-01T01:51:43.78+00:00

What do I do to turn it off. There is no option bto turn off 2factir automation when jbfallow the steps

risolis 8,701 Reputation points

2022-08-01T02:50:39.393+00:00

Hi @Matthew Crosby

Sure, let me give ya the following URL's below

https://answers.microsoft.com/en-us/msoffice/forum/all/turning-off-app-passwords-in-multi-factor/2d20e17c-9566-4a98-9836-fd82a3a7492f >>> Steps for Azure Active Directory

https://support.microsoft.com/en-us/account-billing/manage-app-passwords-for-two-step-verification-d6dc8c6d-4bf7-4851-ad95-6d07799387e9 >>> Personal account steps (Outlook.com or Hotmail.com)

Hope that info will be helpful to overcome this.

Cheers,

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Matthew Crosby 51 Reputation points

2023-07-11T23:37:21.0866667+00:00

I need to know what to do. Like how do take off passwordless authenticator. I finally through my phone into a brick wall becuase of how much money im losing is making me sick. Figured a new phone it will go away and start fresh vn such luck. I tried getting fourvother authenticator apps and they do give gve only 6 digits but it says they arent the correct codes. Im having a fucking melt down becuasr its its been months now i cant access my damn bank. I just need step by step intsructions for dummys. I have an android. A galaxy A53
Sign in to comment
risolis 8,701 Reputation points

2022-08-06T22:33:50.267+00:00

Hi @Matthew Crosby

I hope you are having a great day.

I just wanted to know if previous assistance was useful to address your concern.

Cheers,

Please "Accept the answer" if the information helped you. This will help us and others in the community as well
Please sign in to rate this answer.

0 comments No comments
Sign in to comment
Tom Cannon 5 Reputation points

2023-02-24T17:29:47.6033333+00:00

I cannot crack the code as to correction. App is requesting 6 dig confirmation. authenticator provides 8. Is there solution?
Please sign in to rate this answer.
ITA GOMBO 0 Reputation points

2023-05-14T07:19:30.4066667+00:00

This google autenticator that stup , what does that's mean 6 digit,when input it stil can't

Mikhail 5 Reputation points

2023-06-14T14:05:55.5466667+00:00

https://support.microsoft.com/en-us/verifyme
try this one for 6 digit code
Sign in to comment

Share via

How do i get the authenticator to produce 6 digit codes instead of 8?

7 answers