theRazorBlade

Everyone is asking themselves the same question. Parts of this attack were identified last year but the full scale was not appreciated by the people who identified some of the issues. Everyone assumed that good security practices will be enough. So yes, everyone just missed it, and probably would continue to miss it if it wasn't for some unique situation last week which I will share soon.

If you read the end of the article, it suggests a similar idea of adding something to the callback on return that the attacker cannot guess. However, this requires a protocol change which both providers and consumers have to implement and is not something we can roll out overnight. It requires a new version of the protocol.