Tell HN: Somebody implemented something I wrote a blog about

Re:Tell HN: Somebody implemented something I wrote a blog about by xwx on Tuesday September 20, 2022 @10:17AM (#32911958)

If I've understood the linked post, the login panel doesn't have to behave or look different if someone gets the username and password right. You could still show everyone the 2FA input.

It's suggesting that if the username and password are right but 2FA isn't the system should let the account owner know.

[ Parent | on HN ]

Re:Tell HN: Somebody implemented something I wrote a blog about by Rygian on Tuesday September 20, 2022 @10:34AM (#32912172)

I have read the linked post too quickly before sending my initial comment. Indeed, a back-channel notification to the legitimate account owner is probably a good idea.

On the other hand, disclosing to the attacker that they got the password right is not acceptable.

[ Parent | on HN ]

Re:Tell HN: Somebody implemented something I wrote a blog about by runlevel1 on Tuesday September 20, 2022 @10:30AM (#32912129)

Correct. The blog suggests letting them know out-of-band, like via email, not in the login flow.

[ Parent | on HN ]