3 ms·
I think that's typical. Not sure if this is the case, but I think the danger would be if you are able to use a "forgot password" link to enable the token.
by davio 12y ago
I think that's typical. Not sure if this is the case, but I think the danger would be if you are able to use a "forgot password" link to enable the token.
- tankenmate 12y agoIndeed, create a new throw away account; find out where in the PRNG table the password came from for this throw away account. Use that information to guess the next "Reset password" password then use that to hijack the target account.