@SpaceLifeForm@infosec.exchange
2026-09-06 22:27 UTC
@jerry@infosec.exchange
A thought: Always show a 2FA form box whether or not the user has 2FA enabled or not.
A tricky twist: Randomize the order of the username, psssword, and 2FA fields.
Replies (1)
-
@TimWardCam@c.im 2026-09-07 15:56
@SpaceLifeForm@infosec.exchange @jerry@infosec.exchange That's a good way to get passwords recorded in clear in your logs, that is. "Failed login attempt from user [password], password redacted".