Comment by mdg12v

Does not 2fa mean that user will not be redirected out until verification code is entered? I think article needs more clarification. Can you show where phishing atack is possible in the following scenario?: 1. Open login page 2. Enter credentials (step 1) 3. Enter verification code (step 2) 4. Authenticate, redirect.