Not only is it possible, it really isn't very hard to execute. It takes some basic web programming skills. It's been seen in the wild: https://www.schneier.com/

Not only is it possible, it really isn't very hard to execute. It takes some basic web programming skills. It's been seen in the wild: https://www.schneier.com/blog/archives/2009/09/hacking_two-fac.html https://www.schneier.com/blog/archives/2009/09/hacking_two-f...