[sebmellen]

Without a capchta it is possible to iterate through all possible backup codes.

[mqus]

And a captcha... stops this? Even if it did, how about adding a captcha on the second try or just when entering the backup codes?