@tqbf @thenthj they'd have to be phished in near real time to work. ~2 minute window? I'd say that moves the bar up quite a bit over "valid forever" username/password only