Apologies in advance, I'm a beginner and my knowledge of terminology in this field probably reflects that.
I have a question about one-time codes being used with passwords. What inspires me to ask this question is that some prominent government computing agencies (NERSC in particular) has implemented multi-factor authentication. I have google authenticator setup to generate my OTP codes.
The method they show requires one to input the password and the OTP in separate fields. However, in different places I noticed they require 'password+OTP', which led me to discover that this works site-wide, one can just concatenate the OTP to the end of the password and everything works fine.
Which bring me to my real question: Is that vulnerable to timing attacks? The only way I can imagine this to work is by iterating through my supplied password, and checking for a match to the hash/whatever of the password up to the checked point, which as far as I know would let someone time-attack a password out, as theoretically NERSC would not know the length of your password, and thus not know what part of the concatenated password+OTP is password and what is OTP, which leaves brute-force to check if it's a valid password and OTP.
Is this valid logic, or is there something I don't know? I haven't checked if its actually timing attack resistant since it's government property... (they could just wait a set time to return if the password is correct or not?). Is this a concern I should send to the powers that be because there is a better way to do it or am I just a clueless but paranoid beginner?