Won't protect against an offline attack (just will confuse the hell out of the hacker) but might confound an online attack? Until someone gets wise and runs the tool a second time. Loving the chaotic neutral vibes here.

[–] zalgotext@sh.itjust.works 4 points 1 year ago (1 children)

It doesn't really even protect against online attacks though. Like, if you're going through a list of known accounts, by definition it won't be any of those accounts' first time logging in, right?

And if you're not going through a list of known accounts, good luck getting anywhere with your attack any time this millennia

[–] Tarquinn2049@lemmy.world 15 points 1 year ago (2 children)

This would be per session, not lifetime.

[–] kautau@lemmy.world 2 points 1 year ago

This makes it even more cursed

[–] zalgotext@sh.itjust.works 0 points 1 year ago

Function naming could use some work then, it's not obvious that isFirstLoginAttempt would be session-aware.

Sorry, I'll stop being pedantic now