What are some methods for preventing account enumeration on login when accounts have optional two factor authentication?

Without two factor authentication we would just return the same response for wrong username, wrong password, and account doesn't exist. But for optional 2FA the front end needs some way to ask "should I show the second factor UI?". In the best case that mechanism would confirm an account does exist if it has 2FA, but neither confirm or refute the existence of an account without 2FA.

  • bounces head off desk. Make that an answer and collect your internet points.
    – kag0
    May 7, 2019 at 19:01

1 Answer 1


Only allow the front-end to ask if it should show the 2FA UI after the password has already been authenticated.

This doesn't even have to be a separate API, it could be part of the existing login API. The login API could take a username and password, and return something like:

  • Invalid for invalid username or password, or nonexistent account
  • 2FA required for second factor required
  • Success for successful login (no second factor required)
  • Also ensure the second stage API for the 2FA isn't open to enumeration either - e.g. don't return anything other than success/fail.
    – Dave Satch
    May 8, 2019 at 12:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .