As I wrote, "I read EvilPacket to suggest the time-limited challenge is a token stuffed into the cookie." I wouldn't recommend putting a challenge token in the

As I wrote, "I read EvilPacket to suggest the time-limited challenge is a token stuffed into the cookie." I wouldn't recommend putting a challenge token in the cookie, but developers make mistakes. Also, you know DOM injection is a very common problem. It's better if you don't have to assume the website has no DOM injection problems to do the right thing. Therefore, I think it is reasonable to recommend asking password confirmation as a general best practice, since it's a straightforward way to be the safest. I'm not sure why you are arguing with that point.