I stumbled across this TODO and was worried that there was a glaring hole in MFA that I'd somehow forgotten about, but the TODO is just out of date.

These actions are rate limited properly by PhabricatorAuthTryFactorAction, which permits a maximum of 10 actions per hour.

• Remove the TODO.
• Add bin/auth unlimit to make it easier to reset rate limits if someone needs to do that for whatever reason.

• Tried to brute force through MFA.
• Got rate limited properly after 10 failures.
• Reset rate limit with bin/auth unlimit.
• Saw the expected number of actions clear.