For a non-native speaker, could you please confirm or invalidate my understanding of this interesting text:<p>1. They attacked some login&#x2F;api-token unrelated to bcrypt.<p>2. If I use bcrypt-validate for logins and only temporarily associate rotating, random login&#x2F;api-tokens with an account, I should not be prone to such attacks.<p>Thank you very much for your help.