2 ms·

This site should call out common 2FA implementation mistakes, like requiring a special app or device instead of using standard TOTP, not providing revokable pri

This site should call out common 2FA implementation mistakes, like requiring a special app or device instead of using standard TOTP, not providing revokable printable recovery codes, not allowing SMS to be disabled when other 2FA methods are added, or not supporting multiple hardware keys.

julianlam 7y ago
Sounds like a good pull request for Hacktoberfest
woodruffw 7y ago
Here’s a decent list: https://blog.trailofbits.com/2019/06/20/getting-2fa-right-in-2019/ https://blog.trailofbits.com/2019/06/20/getting-2fa-right-in... (FD: I wrote it)