3 ms·
They already have the session and can do anything with it, they don't need a replay.
by GoblinSlayer 3y ago
They already have the session and can do anything with it, they don't need a replay.
- Tainnor 3y agoIt will depend on the application, how often sessions expire, how often you need to input a new TOTP, etc. In particular, think about bank transfers, each requiring a different transaction code (not technically a TOTP, but similar in spirit).