[andrewmcwatters]

Nice! Another tally mark in my, “If you don’t control your own nominal technologies, the minor benefits will eventually majorly screw you,” log.

Seriously, just use Argon2id or scrypt.

Any “fallback” is just you doing what you should have to begin with.

[gorniv]

We actually use 6-digit one-time codes sent to email as a second login method. If we detect brute-force attempts, we switch to using a GUID-based fallback instead of short codes.

So yeah, lesson learned — don’t outsource identity fully. We thought Apple Sign In would be convenient, but it backfired hard.