undefined | Better HN

0 pointsangry_octet7y ago0 comments

Typically this is allowed. Probably because otherwise the server would have to store and compare state, but also because otherwise the user could be locked out for 60s.

0 comments

leni5367y ago

> but also because otherwise the user could be locked out for 60s.

I don't see this. Note that it's not about rate limiting unsuccessful attempts (which obviously should be done to some extent) but not allowing the valid OTP to be used twice. In the worst case once the user logged in he can't login from an other device for 60s. Not a huge limitation. Also AFAIK 30s rotation of the OTP is more common/standard.

j / k navigate · click thread line to collapse

0 pointsangry_octet7y ago0 comments

Typically this is allowed. Probably because otherwise the server would have to store and compare state, but also because otherwise the user could be locked out for 60s.

0 comments

leni5367y ago

> but also because otherwise the user could be locked out for 60s.

j / k navigate · click thread line to collapse