5 ms·
If they have a list of usernames (easy enough to get, or guess), they just have to do an automated series of bulk requests
by peterkelly 13y ago
If they have a list of usernames (easy enough to get, or guess), they just have to do an automated series of bulk requests
- eli 13y agoYou're both overthinking it... How would your web browser normally get the picture from Google during a legit login? Something like submit your username to a page and get a picture back? The bad guys would use exactly the same process just with the malicious server as a MITM.
- peterkelly 13y agoGood point - this would be a very simple way to circumvent it.