13
My password manager locked me out for 6 hours after I failed the 2FA three times in a row
Had to call my brother to dig through my emergency backup codes from a photo he took of my desk last Thanksgiving, and now I'm paranoid about those SMS codes expiring after a set number of tries.
2 comments
Log in to join the discussion
Log In2 Comments
claire_fisher4121d ago
That's actually a great feature and you should be THANKFUL for it. Locking you out after three failed 2FA attempts is the ONLY thing stopping someone who steals your phone from cleaning out your accounts. Those SMS codes are already pretty weak compared to app-based authenticators, so having a limit on retries is basically a necessary safety net. If they didn't expire after a few tries, someone could just brute force your six digit code while you sleep. Your backup code system with your brother is actually smarter than relying on unlimited retries anyway. The paranoia about expiry is misplaced - that lockout saved you from way worse problems down the line.
3
harper_gibson221d ago
Well hold on @claire_fisher41, I gotta push back a little here. Three tries before locking someone out feels pretty harsh when you're just trying to log in from your own phone. There's gotta be a middle ground between security and not making people jump through hoops every time they type a code wrong.
2