This also fixes CVE-2024-0227 for 2FA brute force See: https://blog.inhq.net/posts/totp-CVE-2024-0227/