Change Details

2FA codes are short and shown as the user types them in so failures should be rare. A dedicated attacker can brute-force them given enough time (months if you target a single account, less if you target many in parallel from changing IPs). We should have aggressive alerts for frequent 2FA failures. That would require either dedicated logging or improving `AuthManagerLoginAuthenticateAudit` which currently only learns the outcome of the login attempt, not the step at which it failed (cf {T137194}).

Two-factor authentication codes are short and shown as the user types them in so failures should be rare. A dedicated attacker can brute-force them given enough time (months if you target a single account, less if you target many in parallel from changing IPs). We should have aggressive alerts for frequent 2FA failures. That would require either dedicated logging or improving `AuthManagerLoginAuthenticateAudit` which currently only learns the outcome of the login attempt, not the step at which it failed (cf {T137194}).

2FATwo-factor authentication codes are short and shown as the user types them in so failures should be rare. A dedicated attacker can brute-force them given enough time (months if you target a single account, less if you target many in parallel from changing IPs). We should have aggressive alerts for frequent 2FA failures. That would require either dedicated logging or improving `AuthManagerLoginAuthenticateAudit` which currently only learns the outcome of the login attempt, not the step at which it failed (cf {T137194}).