Yeah, pass the cookie to bypass MFA has been around for like at least half a decade and session hijacking since pretty much the beginning of the web.

https://www.urbandictionary.co...

This article has more technical details and also highlights possible solutions to the currently broken NFT standards, like requiring at least hash of the digital asset on blockchain for instance. https://embracethered.com/blog... Currently there is not cryptographic link between blockchain and digital asset. That way you could at least store it offline and put it in safe to have a backup and proof later you are the owner. Will be interesting when ransomware wipes out some of the big NFT storage providers (seems all quite centralized, many use s3 buckets, few in IPFS.

Very interesting and great to see the transparency. Would be cool to see more details around stats. This post i just read highlights some of the metrics that could be tracked in addition - including # of users who's MFA token got phished: https://wunderwuzzi23.github.i...

- Net user admin /add - Also, via the mmc snap in. But I agree, the modern UI ways are convoluted...