Comment

Comment by watbe

The exploit has been fixed, and this video shows how easy it was to perform: https://www.youtube.com/watch?v=QPl_BJoBaVA

TL;DW: Steam accepted blank recovery codes for password resets, enabling passwords to be changed without needing access to the recovery email account.

I hope someone is writing a new test case.

parent watbe 11 years ago

Discussion

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton