The private key is embedded in the hardware key, there's no way to extract it without an advanced attack involving tearing apart the key. But a practical attac

The private key is embedded in the hardware key, there's no way to extract it without an advanced attack involving tearing apart the key. But a practical attack along the lines of what you mentioned would be to ring someone up and convince them to disclose their cookie. Check out[1] in which the victim disclosed their cookie without the attacker even asking for it. [1] https://hackerone.com/reports/745324 https://hackerone.com/reports/745324