Practical Security

In-Application Defense

Once you have 2FA in place, you’ll definitely want to require it for login. In fact, 2FA at login time is what most people think of when they think of 2FA. But 2FA can also be required by applications before allowing particularly sensitive operations. Examples of sensitive operations include changing passwords, changing the email address used for the current account, and transferring money. Requiring 2FA for sensitive operations means that even if an attacker got past the login 2FA (for example, by physical access to an unattended, logged-in computer, or by Man-in-the-Middling a TOTP login), the phisher would need to bypass 2FA a second time, which is difficult.

Another defense for highly sensitive operations is a four-eyes ...