Exercise 2: Why the One-Time-Code Relay Attack Is Backwards From How It Feels — Possible Solution
====================================================================

WHAT THE ATTACK ACTUALLY DOES
------------------------------
Per this chapter, "the caller triggers a genuine password reset or MFA
challenge on the real account first, then calls claiming to be
verifying your identity, and asks you to read back the code we just
sent you to confirm it's really you." The code the victim receives is
real, and was genuinely sent to their own device - that's what makes
the deception convincing.

WHAT A ONE-TIME CODE IS ACTUALLY FOR
------------------------------
Per this chapter's warn-box, "a one-time code exists specifically to
prove that the person completing an action has access to the
account." The code isn't a neutral piece of identity trivia - it's the
literal security control standing between "someone requested a
password reset" and "the reset actually completes."

WHY THE VICTIM'S OWN INTERPRETATION IS EXACTLY BACKWARDS
------------------------------
The victim believes reading the code back *proves their own identity*
to the caller. In reality, the code was generated for the caller's own
benefit, not the victim's - the caller is the one who initiated the
reset. By reading the code back, the victim isn't proving anything
about themselves; they're handing the caller the exact piece of
evidence the system requires to let the reset actually go through.
Per the chapter, "you are not confirming your own identity to them,
you are handing them the credential that confirms their access to the
account."

WHY THIS DECEPTION WORKS SO WELL
------------------------------
The framing ("confirm it's really you") is designed to make the action
feel protective and cooperative, when it's functionally identical to
just handing over a password. The victim experiences the moment as
verifying themselves; the system experiences it as the account being
compromised.

WHY THIS WORKS AS AN ANSWER
------------------------------
It explains what the code is actually for, contrasts that with what
the victim believes they're doing, and explains precisely why "proving
who I am" and "handing over access" turn out to be the same action in
this specific attack.