I am working on an App that has a login page with a field for username and password, if the password is entered correctly it then asks for the users pin (4-digit code).
My question, does having a pin as the second factor to login really make it any more secure?
If a hacker brute forces a users password, wouldn't using brute force against the pin be even easier since it's only 4 digits and only 0-9?
Also, is there anything else I could do to make it more secure? (Without adding another step to login)