title: Probability of duplicate OTPs generated in a window using OAUTH HOTP?
body: <p>I am using HOTP to generate OTP for second factor authentication. I am using event-based generation of OTP and providing a window of 10 iterations should there be mismatch in the counter of client and server.</p>
  
  <p>However, I am being asked that what happens if an OTP is re-generated from past at any point of time. </p>
  
  <p>Since the OTP is a 6 digit number, there could be only 999999 combinations available for a user. Hence, an OTP cannot be unique in the lifetime and it will be regenerated at some point. Could there be a pattern when a particular OTP repeats? </p>
  
  <p>Also, if an OTP is regenerated within a window size of 10, it could be worse as it would be vulnerable to replay attack.</p>
  
  <p>Kindly guide me on this.</p>