Question: If I were to publicly display the 6 digit code from my google authenticator, would my account security be diminished beyond it's valid life time?

What if it were the code and the time it was generated?

What if it were N sequential codes?

I'd like to know why or why not for each case.

Answer: 
[Google Authenticator](https://en.wikipedia.org/wiki/Google_Authenticator) uses the [Time-based One-time Password Algorithm](https://en.wikipedia.org/wiki/Time-based_One-time_Password_Algorithm) ("TOTP"), which works by computing [HMAC](https://en.wikipedia.org/wiki/Hash-based_message_authentication_code) with a secret key over a timestamp.

HMAC is a [message authentication code](https://en.wikipedia.org/wiki/Message_authentication_code) ("MAC"). The standard security requirement for a MAC is that it be able to resist **existential forgery** (an attacker *who doesn't know the key* should not be able to forge any `(message, tag)` pairs) under **adaptive chosen text attack** (we allow the attacker the ability to cause the defender to compute tags for any messages of the attacker's choice, and to learn from earlier results when choosing new queries).

The TOTP 6-digit result however is not a straight MAC output, but rather a truncation of a MAC tag, so the question could be raised whether truncating the MAC is also a secure MAC. However HMAC, when used with a good hash function, is also believed to be a [pseudo-random function](https://en.wikipedia.org/wiki/Pseudorandom_function_family). PRFs are automatically good MACs, and the truncation of a PRF is also a PRF, so the truncation of HMAC is also a good MAC.

**TL;DR:** Not unless the attacker could break HMAC-SHA1 under unfavorable conditions, which would be a really big setback for the crypto world as a whole, not just TOTP.
The first OTP definition in RFC 2289 based on S/Key had even this design requirement.

It was not ment to implement two factor authentication but to merely protect the password or passphrase. It was simply used to avoid the password crossing the network - obviously it was assumed that the transmission could be evesdropped or unencrypted.

So as already stated, it is a fundamental design in all OTP systems (S/Key, mOTP, OATH) to not allow the guessing of future passwords based on used passwords.

**But:** With an event based algorithm like HOTP you can of course create OTP lists. If you generate an OTP value *now* and post it on the internet but don't use it for login, everyone else can use it. It only gets invalidated, when this very value gets used or a later value gets used.