Every story and comment from the Hacker News API, in a layout borrowed from 2001.
A comment on Reddit Security Incident. Parent comment
1) User inputs username and pw into spurious site.
2) Spurious site prompts for the user's TOTP token.
3) Spurious site proceeds to immediately log in to the real site w/ username, pw, and valid TOTP token.
4) Bad guys get an HTTP session cookie which for many sites lasts practically indefinitely.
There are no comments on this comment yet.
1) User inputs username and pw into spurious site.
2) Spurious site prompts for the user's TOTP token.
3) Spurious site proceeds to immediately log in to the real site w/ username, pw, and valid TOTP token.
4) Bad guys get an HTTP session cookie which for many sites lasts practically indefinitely.