Is this reset mechanism conceptually flawed? Even with one attempt before invalidating the code, you have a 1:999,999 shot of stealing someone's account by lotto. Not bad odds for an automated process.
It's like every account on Instagram has an alternative six digit password.
It's like every account on Instagram has an alternative six digit password.