Post B43Q8bJbHrZhvzjP8a by azonenberg@ioc.exchange
 (DIR) More posts by azonenberg@ioc.exchange
 (DIR) Post #B43Pf8V7L4DSAe4IwC by azonenberg@ioc.exchange
       0 likes, 0 repeats
       
       Ordering groceries from Safeway online for the first time in a while.Because "I'm signing in from a new device" (I'm not, it's the same browsing VM I've used every time I've ordered in the past and I haven't cleared any long lived cookies etc) they're trying to 2fa me by sending a code to my email inbox that expires in only 5 minutes.The email is HTML only with no plain text body.
       
 (DIR) Post #B43PlmsQ8Rex8E8jSa by azonenberg@ioc.exchange
       0 likes, 0 repeats
       
       I have to wonder what kind of excessively by the books compliance or pentest requirement dictated this stupidity.Or are they actually having serious problems with people credential-stuffing grocery orders???
       
 (DIR) Post #B43Q8bJbHrZhvzjP8a by azonenberg@ioc.exchange
       0 likes, 0 repeats
       
       I already have uBO disabled on their site because it was broken and also deactivated noscript for the tab.I still can't search anything, it just hangs on a progress animation.Time to try the emergency Chromium install I keep around for particularly broken websites.
       
 (DIR) Post #B43Q9wMeVoKjVUnVuy by bakachu@infosec.exchange
       0 likes, 0 repeats
       
       @azonenberg if it can be credential stuffed, it will be credential stuffed.  from personal experience i’m quite sure that there was a security person saying ‘let customers use an authenticator app if they want to please’ but management got scared that that would be too much ‘friction’ for customers in the login pathway and that gets one to email 2fa.
       
 (DIR) Post #B43QL8cFIlAYgpQlZg by azonenberg@ioc.exchange
       0 likes, 0 repeats
       
       @bakachu I can understand maybe a 2fa requirement if you select delivery from a store far away from your default. But I can't imagine there's that many people credential stuffing accounts within driving range of my local grocery store.Also 5 minute expiry is ridiculous for email tokens it usually takes me at least 2 mins for new emails to show up in my inbox
       
 (DIR) Post #B43QSDQNozWhdAFzX6 by azonenberg@ioc.exchange
       0 likes, 0 repeats
       
       Huh. Chromium is even *more* broken? I type in the search box and nothing happens, it doesn't even take me to a results page.
       
 (DIR) Post #B43QigcP2ynko6jVWC by azonenberg@ioc.exchange
       0 likes, 0 repeats
       
       Oh. Apparently making a search request for "tissues" triggered the WAF to block me. Maybe it was changing user agents from firefox to chromium from the same IP in quick succession or something?FML