Replying to @jaffathecake and @tomdale
The suggested mitigations seem to change too — there used to be a third bullet point about predictable URLs and anti-CSRF in there. I’m guessing recommendations are evolving as more is worked out?
Tweet · 4 Jan 2018, 21:45 UTC