Hacker News Reader

From the article it was not clear that the 2FA was the 5 digit pin.

10 guess every 10 minutes with an expectation that after 5000 guesses you'll have a correct guess is 3.4 days (500*10 minutes).

View on HN

There's no timing limits but your own, the only limit I could note is 10 per code. You have to guess a lot, but you don't get stopped. There's also nothing you can do as a target, even if you know you're a target. Support cannot disable your account.

Ah wow, no pause after

As a comparison, banks' 2FA will get disabled after too many resets.

Reply on news.ycombinator.com