BlackHat presentation demo vids: SugarSync

This write-up from a BlackHat 2009 presentation demonstrates that SugarSync's password reset process exposed short, guessable reset tokens and allowed unlimited, long-lived reset links; combined with username enumeration and cloud-scale requests, an attacker could mass-generate valid tokens and brute-force account resets over time.