If I implement two factor authentication using TOTP, I (obviously) have to protect against simple brute force attacks of the TOTP value.
If I ask for the TOTP value after successful password login, the attacker already knows the valid password. Since the default length for TOTP value is 6 digits, it's easy to brute force.
- Block user account: Disadvantage of blocking a legitimate user with no way of unblocking.
- Block IP: Might work, but might be bypassed by leveraging a botnet. Should block more than a single IP for IPv6.
Solutions that do not work:
- Block current session: Doesn't work, because the attacker knows the password and can just open another session.
How can a brute force protection be implemented so it doesn't lock out the legitimate user, but still blocks attacks as good as possible?