I am new to the field of security. I thought a lot about the following scenario and could not come up with a good solution
1) Suppose I go to instagram forgot password page. I enter a persons mobile number whose account I want to hack.
2) It sends a 6 digit code to that person.
3) I want to brute force it - around a million combinations.
4) I get 5000 Ips and send 200 requests per IP and brute force it i,e sending requests concurrently from all the IPs. There is a race condition here right. So wouldn't I be able to break in?
As the requests are going concurrently how can you keep a count and block the user after few failed attempts? That is what this guy did L https://www.forbes.com/sites/leemathews/2019/07/15/hacker-discovers-a-simple-way-to-hijack-any-instagram-account/#56e3c87e7b64 Can someone explain how this was possible and how to mitigate it?