How to Handle OTPs via Email and SMS — An Edtech Failure Guide

Short answer: issue one short-lived challenge, store only a verifier and delivery state, then let the...