Lets use Google Authenticator as example. A 6 digit code is generated each 30 second. Each random attempt has 1/1,000,000 chance of success.

Server will usually accept code of ±30s which increased the chance of each attempt to 3/1,000,000

If the attacker tries one code every min for 200 days then he/she will have 92.5% chance of breaking the system.

What are some counter measures that big companies like Google/Amazon/Facebook/Twitter/Microsoft use to mitigate this issue?

Lets use Google Authenticator as example. A 6 digit code is generated every 30 second. Each random attempt has 1/1,000,000 chance of success.

Server will usually accept code of ±30s which increased the chance of each attempt to 3/1,000,000

If the attacker tries one code every min for 200 days then he/she will have 92.5% chance of breaking the system.

What are some counter measures that big companies like Google/Amazon/Facebook/Twitter/Microsoft use to mitigate this issue?