> This still leaks that the account exists and has TOTP enabled tho. You could m...

		duskwuff on Dec 20, 2021 \| parent \| context \| favorite \| on: 6 digit OTP for Two Factor Auth (2FA) is brute-for... > This still leaks that the account exists and has TOTP enabled tho. You could mitigate that by prompting for an OTP code on a random but stable subset of nonexistent accounts -- for example, by hashing the provided username with a server-side secret and requesting an OTP if the hash starts with a zero.

First time I see this idea - I like it!