Skip to content

Comment on 6 digit OTP for Two Factor Auth (2FA) is brute-forceable in 3 days

Comments

(I'm the cofounder at https://clerk.dev)

We - and I'm sure every other vendor - limit OTP tries.

The guidelines for authentication are very well-defined by NIST 800-63B. For example:

In all cases, the authentication SHALL be considered invalid if not completed within 10 minutes.

https://pages.nist.gov/800-63-3/sp800-63b.html#5132-out-of-b...

Depending on the exact type of OTP, NIST may have different guidelines.

AboutSource Built by g1lg1l

Hackerly is an independent reader for Hacker News, built on the public HN API. Not affiliated with Y Combinator.