Comment on 6 digit OTP for Two Factor Auth (2FA) is brute-forceable in 3 daysComments−colinclerk4y(I'm the cofounder at https://clerk.dev)We - and I'm sure every other vendor - limit OTP tries.The guidelines for authentication are very well-defined by NIST 800-63B. For example:In all cases, the authentication SHALL be considered invalid if not completed within 10 minutes.https://pages.nist.gov/800-63-3/sp800-63b.html#5132-out-of-b...Depending on the exact type of OTP, NIST may have different guidelines.
Comments
(I'm the cofounder at https://clerk.dev)
We - and I'm sure every other vendor - limit OTP tries.
The guidelines for authentication are very well-defined by NIST 800-63B. For example:
https://pages.nist.gov/800-63-3/sp800-63b.html#5132-out-of-b...
Depending on the exact type of OTP, NIST may have different guidelines.