Tell HN: Somebody implemented something I wrote a blog about
Related: I think it&#x27;s surprising how many services leak whether or not a password is correct. E.g. bad password =&gt; error, good password =&gt; 2FA prompt.<p>You should verify a user&#x27;s second factor before password.