Sign-Countersign codes were in continual use by the allies throughout WWII. I'm not familiar if other armies used them. There were at times army-wide codes, (like those used on D-day. But smaller units also created their own specific call and countersigns.
The code on D-day was Flash-Thunder. One of the mistakes in Saving Private Ryan and other popular movies is that they switched it around for some reason. The Flash-Thunder challenge-reply had a third sign as well. It was supposed to be Flash. Thunder. Welcome. That final sign of "welcome" confirmed to Thunder that Flash was also legitimate. Also it was ideally supposed to be used in a sentence like this:
A German who overheard the conversation wouldn't know if the sign was friend, pop, or flash. Countersigns could be run, thunder, or storm. Acceptance signs could be welcome, shelter, or hedge. In practice though the signs were frequently used as single words.
Flash-Thunder was only active on D-day. June 7-9 the code was Thirsty-Victory. June 10-12 was Weapon-Throat. June 13-15 was Wool-Rabbit. I haven't heard if Welcome remained part of the code or if other confirmation words were mixed in.
I also believe, but I'm not sure, that these signs were limited to the Americans. I believe the British and Canadian units used different passcodes. An unexpected American who showed up in the British sector could expect to be disarmed and taken prisoner until his identity could be established.
Finally I'm not aware of any particular significance to the words Flash and Thunder. They were changed every few days, and while words frequently had something to do with each other... they didn't necessarily have to. I've also heard that Thunder would be a difficult word for a properly pronounce; the "th" sound not existing in modern German. The words changed often enough. I doubt it was a major consideration.