Etydhv

I noticed in some cases when I get a verification code from Google it may say something along the line of:

"You should not share this code with anyone else and no one from Google will ever ask for this code."

OK, this seems like it's for security reasons, but the code is only a one use code so if you give someone it after it was used then it will not work. (May not apply to giving someone the code before use, however even if someone knows your username and password and was able to get an unused code and that person where to login a new code should be generated for the new session. right?)

Am I missing something, is there any reason not to share the one time code, especially the part about some random stranger calling and asking for it? Also it should of long self expired before someone had the chance to call you and ask for it in the future.

They're not being precise because they don't have to, and precise language might confuse some users.

They could say, for example, "You should not share unused codes that are less than an hour old with anyone else and no one from Google will ever ask for this code."

You and I would know what they mean. My father in law and grandpa won't know why, though. My father in law is a specific example of a person who would see that there are times when he can share codes, and someone scamming him out of his social security check will get access to his email as well. (Yes, most of his inbox is about mind control chemicals added to contrails and how solar flares cause earthquakes, but it might also give someone access to his bank account.)

Since a used or expired token is useless to everyone, there's no point in keeping it, sharing it, protecting it, deleting it, or adding exceptions to general security advice.

I can tell from personal experience that there are users who will do stupid things when you let them know that there are edge cases and nuances to security. Knowing that, if I were to write such a warning to my users, I'd make my statement as broad and general as possible.

It's to prevent social engineering attacks against you. Imagine, for example you logged into your two-factor gmail account on a shady public computer where a keylogger recorded your email address and password (but weren't able to use it while you were logged in), but you have two factor authentication enabled and remembered to sign out at the end of your session. Your account is still safe (though again, it's best not to sign in to your systems using sketchy public computers; because even with two-factor auth someone sophisticated could still potentially do malicious things on your account in the window while you were signed in).

Attackers now have your email address and password. To access your account (say to use your email address to reset passwords for other systems, like order stuff online, access bank accounts, send out spam, or other havoc), they need to get past the two factor authentication system. So they contact you, pretend to be Google, and try and trick you to answer to them with the actual authentication code, so they can fully login to your account. Maybe they call you on the phone (spoofed number that looks like something associated with Google Inc) and say "we see you have 2-factor auth setup, before we can proceed I need you to tell us the code just texted to you", etc.

Expired or already used tokens don't matter, but they just want to get you in the habit of not giving away this information to third parties.

May not apply to giving someone the code before use, however even if
someone knows your username and password and was able to get an unused
code and that person where to login a new code should be generated for
the new session. right?

Wrong. I assume you're talking about a TOTP code generated for example by the Google Authenticator app. TOTP works by storing a shared secret on the client and server (your phone and Google's servers). To authenticate, both the client and server use the secret as an HMAC key to hash the current time, then truncate it to an n digit value (often 6 digits, sometimes longer).

TOTP is not tied to a session in any way, it is entirely based on a shared secret and the current time.

Am I missing something, is there any reason not to share the one time code, especially the part about some random stranger calling and asking for it? Also it should of long self expired before someone had the chance to call you and ask for it in the future.

I imagine they're trying to prevent people falling for scams where someone asks you to send the current code to them. After the code is used, or after enough time has passed to make it no longer valid, the code is useless.

Multiple old codes may contain enough information to allow for brute-forcing of the shared secret, but that's a preimage attack on SHA-1, which is still quite infeasible (ie the codes will allow them to tell if any particular guess for the shared secret is correct, but they could spend several lifetimes guessing and never find it).