2. Phishing and XSRF are effectively the same in this case, no? We're talking about the phisher relaying the challenge to the victim and tricking them into post

2. Phishing and XSRF are effectively the same in this case, no? We're talking about the phisher relaying the challenge to the victim and tricking them into posting the response--which doesn't really require phishing per se, hence the XSRF. Again, I may be misunderstanding the protocol here. :) 4. Yeah. It's a pain in the ass, but they do offer lost-password fallback. Anyway, I wasn't trying to belabor the point; just noting that big sites will probably always offer some lost-password recovery. > there's callback=direct that opens the link instead of pinging it, but it's a huge pain to figure out which browser you used if not the default one. Where can I read docs on the different behavior between callback=ping and callback=direct? I know I could read the source code, but I do enough of that in the office. ;)