3 ms·
Seems like a lot of improvements could have been made here. After you get the code wrong, it should reset and send you a different code. If you get more than 3
by herpderperator 7y ago
Seems like a lot of improvements could have been made here. After you get the code wrong, it should reset and send you a different code. If you get more than 3 wrong in some pre-determined time, it should lock the person out for some other pre-determined time. You could even use exponential backoff time in both scenarios. Keeping the code the same after getting it wrong just seems really stupid.
- hkai 7y agoMathematically, does regenerating the code make a lot of difference? You can simulate that by running a loop that generates a random 4-digit number in each iteration and randomly guessing it. On average, you will guess the number after 10,000 iterations. It doesn't help that you regenerate the number each time. Your chance is still 1/10,000.