One side effect of building out a rate limiting/throttling engine is that I'm able to repurpose it for other forms of throttling, not just payments.
In fact, tonight I'll be rolling out the first of those changes: you will not be able to use the same two factor authentication code more than once, even if it is still valid for the current 30 seconds.
This is a security measure to protect you from phishing: imagine an attacker sets up a clone of stellarguard.me, called steIIarguard.me (those are capital ii instead of L) and you fall for it and enter your username/password and a two factor authentication code. The attacker may gain access to your account, but if you have your security mode set to "high" they will not be able to perform any payments/account settings changes without entering a brand new valid two factor auth code, not the one they just phished from you.
This is just one small security improvement that I've got planned. Much more to come!
