Timeline for Why not ask for a password and 2-factor token at the same time?
Current License: CC BY-SA 3.0
5 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Oct 15, 2021 at 2:21 | comment | added | Ubaidah | @Gruvw very good point, but I think over today computer networks a timing-based attack is not simple to execute ( to give reliable results) most likely the account will be locked before the attacker collect enough results. You could also potentially delay the respond to confuse a timing-based attack | |
| Oct 12, 2021 at 20:03 | comment | added | gruvw | It does not really increase security, as a timing based attack can be used to determine if it's the password or the OTP that went wrong. | |
| Jan 28, 2019 at 10:01 | comment | added | ojrask | The system can be made to tell the user if the password was wrong or the MFA code was wrong. They are validated separately which allows them to send separate error messages to the UI. | |
| Apr 18, 2014 at 7:31 | comment | added | SPRBRN | Interesting, and this gives the impression that consecutive method is insecure. However, it really makes a difference when you're talking about millions or billions of possible passwords. | |
| Apr 10, 2014 at 8:37 | history | answered | Ubaidah | CC BY-SA 3.0 |