It doesn't really even protect against online attacks though. Like, if you're going through a list of known accounts, by definition it won't be any of those accounts' first time logging in, right?

And if you're not going through a list of known accounts, good luck getting anywhere with your attack any time this millennia

[–] Tarquinn2049@lemmy.world 15 points 7 months ago (2 children)

This would be per session, not lifetime.

[–] kautau@lemmy.world 2 points 7 months ago

This makes it even more cursed

[–] zalgotext@sh.itjust.works 0 points 7 months ago

Function naming could use some work then, it's not obvious that isFirstLoginAttempt would be session-aware.

Sorry, I'll stop being pedantic now