Better customer verification tokens

[Andrej]

I would argue the fail is yours.

View attachment 46898

^ Every time you click that link, you should get a new token (according to Mike). That's not the case.

From xenforo.com/api:

Clicking that link will generate a token if you don't have one for that license or display the current token if one has been generated.

 

[Adam Howard]

Everytime you click that link, it will open an overlay to show you the last generated token.

It will show you the same token every time, until such time as you re-generate it clicking the regenerate token button.

Clicking that link does bring up a new token. Clicking it again, brings up a new token. Keep clicking it and eventually it will report.

 

[Slavik]

Clicking that link does bring up a new token. Clicking it again, brings up a new token. Keep clicking it and eventually it will report.

Then theres something wrong with your PC. This is not the intended behavior, nor is it a behavior that happens on any of my 4 machines, on IE, Firefox, or Chrome.

 

[Adam Howard]

Then theres something wrong with your PC. This is not the intended behavior, nor is it a behavior that happens on any of my 4 machines, on IE, Firefox, or Chrome.

I'll bite.

How would my computer bring up a repeated token from XenForo.com services, that can be used?

 

[Biker]

Then theres something wrong with your PC. This is not the intended behavior, nor is it a behavior that happens on any of my 4 machines, on IE, Firefox, or Chrome.

Agreed. I just tested it and the same token appears when I click the link. I regenerated the token and tested again. Same token appears.

 

[Adam Howard]

Agreed. I just tested it and the same token appears when I click the link. I regenerated the token and tested again. Same token appears.

Thank you for validating and confirming this

 

[Biker]

There's nothing to validate. You claimed clicking the link generated a new token each time.

 

[Slavik]

I'll bite.

How would my computer bring up a repeated token from XenForo.com services, that can be used?

The only thing I could suggest is your caching settings mean after you re-generate a token, then re-open the overlay, it is showing you a cached version of the overlay.

However, that "cached" token shown to you will not work from the moment you click the regenerate button.

 

[Sheldon]

I just did about 35 consecutive "Regenerate Tokens", from the overlay, and 0 repeated.

 

[Adam Howard]

The only thing I could suggest is your caching settings mean after you re-generate a token, then re-open the overlay, it is showing you a cached version of the overlay.

However, that "cached" token shown to you will not work from the moment you click the regenerate button.

Clicking on the "generate token" took a while to get a repeat, but when I did it was valid

So .... I don't know.... You're call.

 

[Slavik]

Clicking on the "generate token" took a while to get a repeat, but when I did it was valid

So .... I don't know.... You're call.

Then you should buy a lottery ticket for tonight, you must be be the luckiest person on XenForo to re-generate the same token multiple times against the 1 in however many hundreds of trillions of combinations there are available.

 

[Adam Howard]

Then you should buy a lottery ticket for tonight, you must be be the luckiest person on XenForo to re-generate the same token multiple times against the 1 in however many hundreds of trillions of combinations there are available.

LMAO

You have a good sense of humor Slavik. Don't let anyone tell you different.

 

[Kent]

Doing the method described in my original post is not good because it can lead to a hash extension attack, so disregard it completely.
Though I still believe a better method could be used to verify customers which does not put customers at the risk of impersonation.