So a bit of a strongly worded title. I'm going to nitpick for a second. First you need the device-id, second you need the code that will be sent via text. The

So a bit of a strongly worded title. I'm going to nitpick for a second. First you need the device-id, second you need the code that will be sent via text. The code sent via text is 6 digits meaning 10^6 == 1MM permutations. He shows how he can enumerate these using 1K IP's ultimately bruteforcing the reset code. The Device ID is still not captured although I'm guessing they allow handwaving via a malicious app or something of that nature. Credit where credit is due, he cleverly enumerates them concurrently across 1K IP's and earned his bonus. Interested how they fixed it...guessing adding a random session guid in the url and maybe increasing entropy && length of the secret.