Adam Shostack :donor: :rebelverified:<p>Playing with phanpy.social, it seems that authorizing new apps to access mastodon doesn't require a two factor auth code.</p><p>While I haven't fully threat modeled it (you're already logged into the browser, so someone with browser access may not represent a shift in trust boundary, it feels off.</p><p><a href="https://infosec.exchange/tags/mastodon" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>mastodon</span></a> <a href="https://infosec.exchange/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>security</span></a> <a href="https://infosec.exchange/tags/accidentalpentest" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>accidentalpentest</span></a> <a href="https://infosec.exchange/tags/sbd" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>sbd</span></a> <a href="https://infosec.exchange/tags/threatmodel" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>threatmodel</span></a></p>