Merge pull request #240 from davidalger/patch-1

Update default OTP Window for Google TOTP to 1 per recommendation in RFC 6238

Author: nathanjosiah

TwoFactorAuth/etc/adminhtml/system.xml

@@ -42,7 +42,7 @@
                 <field id="otp_window" translate="label comment" type="text" sortOrder="10" showInDefault="1"
                        showInWebsite="0" showInStore="0" canRestore="1">
                     <label>OTP Window</label>
-                    <comment>This determines how long the one-time-passwords are valid for.</comment>
+                    <comment>This determines how long the one-time-passwords are valid for. An OTP Window of 1 will result in the current OTP value plus 1 code in the past and 1 code in the future to be valid at any given point in time.</comment>
                 </field>
             </group>
             <group id="duo" translate="label" type="text" sortOrder="40" showInDefault="1" showInWebsite="0"

TwoFactorAuth/etc/config.xml

@@ -21,7 +21,7 @@
                 <application_key backend_model="Magento\Config\Model\Config\Backend\Encrypted"/>
             </duo>
             <google>
-                <otp_window>30</otp_window>
+                <otp_window>1</otp_window>
             </google>
         </twofactorauth>
     </default>