3 ms·
It is important to distinguish between active and passive attacks. The verification code generated is valid only for a very short time - so unless the hacker p
by Shahukaar 16y ago
It is important to distinguish between active and passive attacks.
The verification code generated is valid only for a very short time - so unless the hacker phishes the code, and uses it within 10s of seconds, the code is not valid.
- LordLandon 16y agoNothing's stopping the phishing site from going and logging in once the token's phished, and logging the cookie as opposed to just logging the password+token. And you get a lot more seconds if you log in within those 10 seconds.