Re:Peach App Token Reuse Flaw
by dthakur on Monday January 18, 2016 @08:58PM
(#10928424)
Sounds like a storm in a teacup if indeed the endpoint is served over TLS.
[ Parent
| on HN ]
Well, no. Rather it's a threat vs vulnerability case.
There exists a vulnerability, because the Peach tokens (seemingly) never expire, and thus are vulnerable to replay attacks.
However, because authorization uses TLS, it's very unlikely it will be exploited, because TLS mitigates MITM attacks.