Christopher B
1/25/24, 11:43:00 AM EST
But that does not change the security. I like having both because the user might have pressed the button twice etc
Ian M
1/25/24, 11:43:16 AM EST
At least there aren't 5000 good passwords out there, there is just one
Ian M
1/25/24, 11:44:27 AM EST
And I don't think it should be able to be used more than once - the idea I think is it's One Time Password/OTP
Christopher B
1/25/24, 11:44:29 AM EST
Well we can throttle both sides. only request one or two and only try a few times
Christopher B
1/25/24, 11:46:01 AM EST
If we keep the counts down then I think its good. We can also expire them once they login ok so its one time
Ian M
1/25/24, 11:46:56 AM EST
Keep the most recent 5 or something, max 24 hours, and only good once
A successful login should clear out all 5
A successful login should clear out all 5
Christopher B
1/25/24, 11:49:41 AM EST
How will you keep them from trying to login so often? Maybe we use one code only and put the retry count on it?
Christopher B
1/25/24, 11:50:18 AM EST
I would rather it email out the same code twice than make new codes.