2026-06-03 17:54 UTC
@dangoodin@infosec.exchange you only need to try every option if you want to guarantee getting into a particular account. If you try a small number of codes against a large number of accounts, statistically some of them will match. And if that locks out the rest of the accounts, so be it...
Replies (2)
-
@GuillaumeRossolini@infosec.exchange 2026-06-03 18:12
@cibyr@omg.wtf.sh and that’s essentially a denial of service, so if you’re trying to hurt the company, job done @dangoodin@infosec.exchange
-
@dangoodin@infosec.exchange 2026-06-03 18:29
@cibyr@omg.wtf.sh Right, but to brute force 2FA, don't you first have to break the first authentication factor? That would mean the number of accounts you can brute force is limited to only those you have already compromised.