3 ms·
"from my understanding it still is possible to steal the SSO token" Isn't that precisely what spoofing is?
by jtbayly 6y ago
"from my understanding it still is possible to steal the SSO token"
Isn't that precisely what spoofing is?
- lhoff 6y agoI wasn't arguing the spoofing part but the important vs. critical part. The same bug for ankther platform is ranked as critical. The thing is that according to Microsoft critical spoofing is not possible.
- donmcronald 6y ago> Isn't that precisely what spoofing is? Not in my opinion. I’ve always thought of spoofing as a write only type thing where you can impersonate someone, but not have access to any of their existing data. Email spoofing is a good example of this. Token theft is WAY more severe because it gives you complete access to everything. It’s total control. You can exfiltrate data and that’s what I’d consider the biggest difference, at least in my opinion.