Timeline for Why not ask for a password and 2-factor token at the same time?
Current License: CC BY-SA 3.0
4 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Apr 10, 2014 at 17:40 | comment | added | user42177 | I guess it depends exactly what risk you're trying to overcome - you need to be careful you're not avoiding one risk at the expense of another. For example, you could be preventing username/password verification without a token, but enabling easy username/2FA usage enumeration. | |
| Apr 10, 2014 at 7:54 | comment | added | anthonyryan1 | I'm talking about an XHR request with the username. I'm not trying to reduce the number of requests. I'm trying to improve the user experience while maintaining the same level of security. | |
| Apr 10, 2014 at 7:45 | review | First posts | |||
| Apr 10, 2014 at 11:04 | |||||
| Apr 10, 2014 at 7:18 | history | answered | user42177 | CC BY-SA 3.0 |