Does anyone understand what's going on here? They expect some kind of request to be signed with a certain key, but what is that request and what does it get you?
I guess they just bruteforce OTP by sending all combinations of four digits to the server and eventually one works.
I guess they just bruteforce OTP by sending all combinations of four digits to the server and eventually one works.