News for hackers. Stuff that matters.

A comment on Gitlab Critical Security Release. Parent comment

Re:Gitlab Critical Security Release by nijave on Saturday February 26, 2022 @01:11PM (#30480082)
It enables phishing where you're actually logged in after submitting your credentials. You don't need a MITM from a network perspective.
[ Parent | on HN ]
Re:Gitlab Critical Security Release by hedora on Saturday February 26, 2022 @07:44PM (#30483986)
Separately, if the attacker has the password and a mitm for the totp code, then this allows them to logg in without being detected.
[ Parent | on HN ]