Conversation

For security, it’s better to only give feedback after all 3 have been entered, and to not say which piece is wrong. Only question is how many steps the input process should be.
1
2
While there's probably an arguement that asking for all three at the same time is more effecient, so is dvorak. ;) Everybody else is asking for 2FA in a second prompt...
1