3 ms·
In devise at least reset tokens expire, so they'd need to have been set in the last day to be useful, which narrows that attack considerably doesn't it?
by grey-area 12y ago
In devise at least reset tokens expire, so they'd need to have been set in the last day to be useful, which narrows that attack considerably doesn't it?
- homakov 12y agoWhy wait and not use it right away? If you have read access now you can exploit now.
- grey-area 12y agoOh I see - you mean they have read access, then trigger password reset, then use the token straight away? That does mean they'd be firing off emails which would alert users though.
- homakov 12y agoIt would. They didn't do it probably because they didn't try this trick. But they could i think.
- homakov 12y agoBTW actually new version of devise hashes tokens.