I have come across scenarios where a website would send OTP once a user has supplied valid username/password. A confirmation dialog e.g. An OTP has been sent to your registered mobile number would be displayed to the user. When a user has failed to supply valid username/password, an error message informing user that the either username or password is incorrect is displayed and so it would not even reach the OTP stage.

My understanding is that such implementation can be abused. Assuming that attacker has managed to get the list of username or password and then combines it with automated brute force or password spraying attacks, he would be able to arrive at valid username/password pairs.

Assuming that my assessment is correct, what steps can be taken to minimize this risk?

1 Answer 1


Given common practice, one doesn't need the 2FA message for confirmation.

Most logic flows validate credentials and then trigger a 2FA process if one is set up for the user. Just triggering the 2FA process, message or not, is enough to confirm valid credentials.

The risk is that the person could turn 2FA off, which would then allow an open door for anyone who was able to confirm the credentials.

The potential mitigation on the server-side is to ask for the credentials and 2FA all at once, but that becomes a UX nightmare for those who do not have 2FA set up, or if the site offers different forms of 2FA. It would be the same UX problem if the site triggered a fake 2FA process on invalid/wrong credentials.

The mitigations on the user side are to not turn off 2FA, and if you do, to change your password.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .