3 ms·
> I had someone try to send a Twitter reset code with the goal of getting me to show the code on the video. Wow -- that seems like it would be a very low risk/
by patrec 5y ago
> I had someone try to send a Twitter reset code with the goal of getting me to show the code on the video.
Wow -- that seems like it would be a very low risk/effort for pretty decent chance of success attack. Experienced streamers will likely have all notifications for stuff not directly related to their stream turned off anyway, not just because more security awareness but also because it's a distraction; but does anyone know if less experienced people get regularly caught out by this?
- capableweb 5y agoI don't get how this could be used as an attack, unless whatever is displaying the tweet is vulnerable somehow? What kind of "reset code" are we talking about and why would just displaying it be harmful? Executing it I can understand, but just displaying? Edit: I think I just figured it out, it's referring to "password reset code" that you can get if you try the "forget my password" option on login pages (not "code" as in "software code"), displaying that code would allow others to (possibly) set their own password for your account, would make sense as an attack vector in this case. Duh.