This is one of the main things I test when doing application security assessments.<p>I look at the various clients&#x2F;interfaces and test each of them to see how their controls compare. It&#x27;s quite often that certain clients or interfaces have far less security on them than others because it simply isn&#x27;t convenient.<p>One example would be two-factor on a VPS administration page.  It&#x27;s on the main site, but if you download the mobile app it&#x27;s password only.<p>Which means...it&#x27;s password only (assuming you know how to use a proxy like Burp).<p>So important to ensure that all interfaces to your app have the same minimum requirements for security.