ignoring people just clicking 'yes' on popup boxes... if JS execution was limited to 60 seconds, and the attack takes ~5 mins, limiting the attack to 59 seconds

ignoring people just clicking 'yes' on popup boxes... if JS execution was limited to 60 seconds, and the attack takes ~5 mins, limiting the attack to 59 seconds would still have a 1/5 success rate. It doesn't close the vuln and just adds un-necessary friction for users.