Stealing passwords from infosec Mastodon - without bypassing CSP

Write-up from Nov. 2022, but I figured this would be interesting to people on the fediverse