Lesson 09 · 11 min
Brute force, 2FA, and security headers
The last layers: limit attempts, add a second factor, close browser holes.
Even a good hash won't save simple passwords from brute force if attempts are unlimited. Limit sign-in attempts by IP and by account, and add a delay after failures. Two-factor authentication (2FA) requires, besides the password, a code from an app (TOTP) or a passkey: a stolen password alone no longer opens the account. Security headers close attacks in the browser.
Sign in to continue
The rest of this lesson opens after sign up
The first lesson of every course is open without an account. To read on, solve the practice and use Ask, create a free account or log in.