3 ms·
Note that this is not universal to all systems. If your 2FA options all require the user to enter a code, you can simply display a "Please enter your 2FA code"
by BeefWellington 4y ago
Note that this is not universal to all systems.
If your 2FA options all require the user to enter a code, you can simply display a "Please enter your 2FA code" dialog without divulging what kind of 2FA the user has.
- dalmo3 4y agoHow would you prevent someone from spamming a user just by knowing their username? Say, if the 2FA is done by SMS, or email. An attacker brute-forcing the password could flood the user with multiple messages. The usual response is doing a password reset, but that wouldn't work in your system. I wonder how systems that use magic links handle this.
- ezekg 4y agoYour authentication system should have per-user and per-IP rate limits.
- Tangurena2 4y ago> How would you prevent someone from spamming a user just by knowing their username? Wasn't something like this how Uber got hacked recently? Spamming the target until they clicked "yes" on the 2FA prompt?