Every website that I came across that uses two-factor authentication asks the user for their password first. Then, after a correct password was entered, an SMS or an e-mail is sent that contains another code you have to enter in order to actually get logged in.
I wonder why that is the prevalent scheme, since I could come up with mechanisms that seem to be much secure to me:
- Asking for an external authentication first.
- (Pro) The attacker cannot try different passwords first. This seems especially advantageous if the user reuses their passwords.
- (Con) The user could be spammed this access codes.
- The con could be easily fixed by using a cool down between requests.
- Only sending a code if the password was right, not telling if the password was right or not.
- (Pro) The attacker cannot know if the entered password was right or wrong.
- (Con) A user may be annoyed the they don't receive their code, since they don't see directly if the entered password was right.
- That con could be fixed by sending the user a message that a wrong password was entered, or only truthfully telling the user/attacker 3 times if the entered password was wrong, and say it's right afterwards for any password.