@gglockner@social.seattle.wa.us No, that's not the explanation. Like password spraying (when the term is used correctly), 2FA spraying defeats rate limiting. It's explained in the article.