• 0 Posts
  • 48 Comments
Joined 1 year ago
cake
Cake day: July 31st, 2023

help-circle

    1. The attackers used IPs situated in their victims regions to log in, across months, bypassing rate limiting or region locks / warnings

    2. I don’t know if they did but it would seem trivial to just use the tokens in-situ once they managed to login instead of saving and reusing said tokens. Also those tokens are the end user client tokens, IP locking them would make people with dynamic IPs or logged in 5G throw a fuss after the 5th login in half an hour of subway

    3. Yeah 2FA should be a default everywhere but people just throw a fuss at the slightest inconvenience. We very much need 2FA to become the norm so it’s not seen as such