This is basically the same thing as MobilePass, which hasn't been broken to my knowledge, so I wouldn't expect a direct attack. Your suggestion is a possibilit

This is basically the same thing as MobilePass, which hasn't been broken to my knowledge, so I wouldn't expect a direct attack. Your suggestion is a possibility. There are also a bunch of unknowns. Are there any direct attacks (SQL injection, privilege escalation, etc) on the StrongWebmail site? What sort of datacenter is it in (alchemy.net, which are HIPAA compliant, which should be pretty safe)? Are the challenges generated in a cryptographically secure manner? How secure is the CEO's home machine? Does the CEO purge cookies at the end of the session? Does it count if I can manage to redirect his e-mail elsewhere instead (which can be done with well-known DNS exploits)? Part of the defense here is that the prize is small enough that it's not worth trying many of the more elaborate tricks (like attempting to break the PRNG for the keys, if any).