4 ms·
You would have to randomize the error when the wrong password is inputed and ensure that for a particular username the returned error is invariant. Else an atta
by nick__m 4y ago
You would have to randomize the error when the wrong password is inputed and ensure that for a particular username the returned error is invariant. Else an attacker could infer that when you get a different error you have a correct password.
- ezekg 4y agoThe bad password error would only be sent if the second factor is valid, though.