I found it again: https://www.bentasker.co.uk/posts/blog/security/seducing-a-r...