3 ms·
What confuses me is that at the end of the day the challenge and response need to be sent over HTTP. Why can’t you copy the response from the real device and “
by runnerup 4y ago
What confuses me is that at the end of the day the challenge and response need to be sent over HTTP.
Why can’t you copy the response from the real device and “play” (not replay) it from a fake device?
- g_p 4y agoI believe you could do relaying like this, if suitably determined. You would need to do it in near real-time, and no doubt the endpoint giving PATs will be rate-limited. At some point the amount of manual effort to automate this (do you have an API to retrieve the token programmatically from another app?) will exceed what it is worth to avoid a captcha! I suspect you will find it is hard to gwt the real response out from the trusted browser.