Re:How I could have hacked any Facebook account
by mayneack on Tuesday March 08, 2016 @06:58PM
(#11249813)
It's not really unrestricted. Given that this is forcing the password reset, you can't silently do it, right? So anyone exploiting it knows there's a limited number of uses before people notice that their passwords are being reset by not them.
[ Parent
| on HN ]
Re:How I could have hacked any Facebook account
by arcticfox on Wednesday March 09, 2016 @01:13AM
(#11251251)
True, the restriction is that you only get a guarantee of getting in one time. I meant that there are no restrictions on what you can do once you're in. (E.g. a XSS chat hack or something like that would be restricted in that sense)