7 ms·
OWASP actually includes this suggestion in their guidance for implementing MFA: https://cheatsheetseries.owasp.org/cheatsheets/Multifactor_Authentication_Cheat
by spuz 4y ago
OWASP actually includes this suggestion in their guidance for implementing MFA:
https://cheatsheetseries.owasp.org/cheatsheets/Multifactor_Authentication_Cheat_Sheet.html https://cheatsheetseries.owasp.org/cheatsheets/Multifactor_A...
> When a user enters their password, but fails to authenticate using a second factor...:
> ...
> Notify the user of the failed login attempt, and encourage them to change their password if they don't recognize it.
> The notification should include the time, browser and geographic location of the login attempt.
> This should be displayed next time they login, and optionally emailed to them as well
- Cthulhu_ 4y agoYeah I thought it weird that you only get an e-mail that someone logged in under a new account - passing the 2fa. But they should send one after correct username / password too. I don't mind getting an e-mail as another form of 2fa, but that has its own issues.
- travisjungroth 4y agoI think the email is just a failure notification, not a second factor.