Can someone explain how this was possible
It was possible due to a lack of rate-limiting on the action/request. As you said, it could be brute-forced hence.
Instagram has now patched this issue. I haven't seen any official publication on the mitigation measures, but a quick visit to Instagram's Password Reset Page reveals the [intended] user is now sent a ...
Storing OTP tokens (as well as password hashes) in a separate DB would be helpful against read-only SQL Injection vulnerabilities in the main database. This could be considered as a second layer security measure, last resort after your main DB was compromised, however I can’t decide for you whether it’s worth the added complexity.
tldr: The approach you outline fails do address the actual problem, use a separate application and a secure authentication scheme.
While you are right that keeping account credential information with the rest of the lot (i.e. whatever your application actually uses when it's not authenticating users) is a bad idea (tm), the approach to just have a second ...
The whole point of 2FA is to require the second factor to login. Usually - password+token, in recovery situation - password+recovery key. Something you know + something you physically have.
If you can use secondary email as a recovery option for 2FA, the user account is protected by their password + the recovery email password, thereby defeating the goal of ...
Your threat model may be different from other people's, but generally speaking, if you have hardware keys but SMS can still be used to reset access, then SMS is the "weakest link in the chain" and could be exploited.
You could disable SMS to mitigate this. Google offers a pre-configured approach to move to require only strong second factors, called the ...
When you setup a new hardware token, you're usually presented with one of two options: you can either let the token generate a new key or you can program it with a key you generated outside the token.
By design, keys that are stored by a 2FA token cannot be read out of the token. That doesn't mean that in the future, someone can't find a vulnerability in ...
I am not aware of a diagram set but there is veris:
It translates the "Who did what to whom using which attack vector" in a structured JSON Format. It uses a 4 dimensional model for threats to describe any incident.
So the example model from above would be slightly different, you can model every incident ...