Post by @lauren@mastodon.laurenweinstein.org

@lauren@mastodon.laurenweinstein.org

2026-06-03 18:21 UTC

@GuillaumeRossolini@infosec.exchange @dangoodin@infosec.exchange If you can't stuff it, and if it is a TOTP system, the only other likely possibilities involve issues like deeper implementation issues (e.g., more than one response will match, making the search space much smaller, etc.). Or there's something else going on entirely. Not enough info.

Replies (1)

@GuillaumeRossolini@infosec.exchange 2026-06-03 18:35

@lauren@mastodon.laurenweinstein.org oh yes the article is definitely low on details and it reads like they are using words that may bring some empathy I’m guessing there was a combination of a leak somewhere that allowed the attacker to spray passwords, identifying the accounts they could even try to attack further Then the brute force aspect on those, but really, how fast did their automated system catch on? Can it be called a brute force attack if each account saw 5 tries before being put on hold? Or did they consider that because of how many accounts were targeted (which they don’t say), it still counts as brute forcing? And this gem Our team has taken steps to mitigate the risk of future incidents and continue to harden our resiliency @dangoodin@infosec.exchange

Open ##5187587