#accidentalpentest — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #accidentalpentest, aggregated by home.social.
-
Playing with phanpy.social, it seems that authorizing new apps to access mastodon doesn't require a two factor auth code.
While I haven't fully threat modeled it (you're already logged into the browser, so someone with browser access may not represent a shift in trust boundary, it feels off.